The Best-Paying Bug in Bounty Isn’t the One Everyone Hunts

30-Second Version:_ 4,590 disclosed reports, eleven bug types, one uncomfortable table. XSS is the most-hunted class on HackerOne by a mile — 2,394 disclosed reports, seven times the pool of the next-largest type. It also has the lowest per-report average of all eleven types: $1,081. RCE, by contrast, averages $4,840 a report — four and a half times more — with a fraction of the competition. The crowd is optimizing for the biggest total pot and getting the thinnest individual slice in the entire dataset._

The most-hunted vulnerability class on HackerOne — by a margin nobody else comes close to — is cross-site scripting. The disclosed record holds 2,394 XSS reports. The next biggest pool, remote code execution, has 334. Seven times smaller.

Here's what the crowd's choice actually buys them. The average disclosed XSS report that earned a bounty earned $1,081 — the lowest per-report average of all eleven major bug types. The average paid RCE report earned $4,840. Four and a half times more, for the class most hunters apparently aren't seriously targeting.

That gap isn't a quirk. It's the whole economics of bug bounty sitting in one table, and I built the table before I believed it myself.

What I Counted

The base is the community dataset at reddelexc/hackerone-reports, which tracks disclosed HackerOne reports by bug type. I pulled the full lists for eleven types — XSS, RCE, account takeover, auth bypass, SQLi, SSRF, OAuth, race conditions, business logic, IDOR, GraphQL — 4,590 reports total. For each type: how many reports, how many paid anything, what they paid in total, and the top bounty. Headline cases verified against each report's live JSON, not the dataset alone.

Two honesty notes before the numbers do their work. Disclosed reports aren't all reports — programs disclose selectively, and the pool skews toward big-name programs, some of which pay in thanks instead of cash. And averages hide distributions. Both caveats cut in the same direction: the real gaps here are probably wider than what's actually countable.

The Quiet King: RCE, $4,840 a Report

Remote code execution. Unsexy, difficult, rarely the subject of beginner content — and the best-paying class per report in the entire dataset. Seventy-nine of its 334 disclosed reports earned bounties, and those that did averaged $4,840, with a total pool of $382,380 on far fewer findings than XSS needed to reach its own total.

The ceiling is exactly where you'd guess: total control of a machine. A Critical 9.9 RCE on GitLab (report #1609965) — via the DecompressedArchiveSizeValidator and Project BulkImports, sitting behind a feature flag — paid $33,510. When the impact is "run code on the server," the bounty table doesn't negotiate.

The trade is honest, though: RCE is the hardest class on this list to actually find. Which is precisely why it pays like it does. The market isn't stupid — it's pricing in a real premium for scarcity.

The Crowd's Math: XSS, $1,081 a Report

Now the other end. XSS has the largest pool (2,394), the most paid reports (502), and the largest total pot on the board: $542,692 — more cash than any other bug type in the entire dataset.

And the worst per-report average of all eleven. $1,081.

Both facts are true at once, and the resolution is the actual lesson. XSS's pot is volume, not value — five hundred paid findings adding up to something that RCE's seventy-nine nearly matches on its own. The class does have a real ceiling: the famous stored XSS bypass on paypal.com/signin (report #510152) paid $20,000 at High severity, 2,682 upvotes. But that's a bypass of a previously-patched, heavily-monitored PayPal login flow. The average XSS is a reflected alert box on a program that pays like it's reflected.

Hunters read "biggest total pot" as "most opportunity." The correct reading is "most competition, thinnest slices."

Three Axes, One Decision

Every bug type scores differently depending on which axis you rank by, and the axes flatly disagree with each other:

Total cash paid — XSS wins ($542,692). Largely irrelevant to any individual hunter — nobody collects the pool's average, you collect your own report's value while competing against everyone else drawing from the same pot.

Average per paid report — RCE wins ($4,840). This is the closest real proxy for "what is one finding actually worth."

Conversion rate — the share of disclosed reports that earned anything at all. GraphQL wins here, and it isn't close: 35% of its disclosed reports paid, against 15–30% everywhere else on the board. A small pool (72 reports), but the best odds per attempt of any class here.

The crowd optimizes for the first axis without ever realizing it's the wrong one. The rational choice balances the second and third — value per finding, multiplied by the actual probability of landing one.

The Rest of the Board

Account takeover averages $3,864 and owns the single biggest bounty in the entire dataset: $35,000, Critical 10.0, for a password reset that worked without any user interaction at all (report #2293343). It also has the harshest filter on the board — just 15% of its disclosed reports paid anything. Owning an account outright is worth a fortune; almost owning one is worth almost nothing.

Auth bypass follows at $2,590, its top bounty $20,160 for a pre-auth RCE on Twitter's VPN (report #591295) — filed under auth, paying like RCE, because scoring follows the actual impact, never the category label.

GraphQL pairs a $2,632 average with that 35% conversion rate — the best value-per-attempt profile anywhere on the board, sitting in the smallest pool of the eleven.

SQLi ($2,257 average, the $25,000 Valve ceiling covered in more depth elsewhere in this series) and SSRF ($1,896, with a healthy 30% conversion) fill out the middle of the pack. Then a real drop: OAuth, race conditions, business logic, IDOR, and XSS — all averaging somewhere between $1,400 and $1,080.

Six of Eleven Famous Reports Paid Nothing

One more pattern, and it runs straight through the whole board. Look at the single most-upvoted report in each type — the fame leaderboard. In six of the eleven types, that most-famous report earned exactly $0: the Starbucks payroll-database SQLi (report #531051, 797 upvotes, Critical 9.3), the Steam Client buffer-overflow RCE (1,288 upvotes), the Lyft expense-report SSRF (653 upvotes), the Reverb gift-card race (305 upvotes), the HackerOne GraphQL data exposure (report #489146, 1,032 upvotes, Critical 9.3), and the Shopify OAuth misconfiguration (526 upvotes).

Upvotes measure spectacle. Programs pay impact — but only on programs that pay at all. The most famous finding in a class being worth exactly nothing is the ecosystem saying, eleven different ways, that attention and money are simply different currencies.

So What Should You Hunt?

Not XSS by default, and that's the practical point underneath all of this. The data's actual argument, caveats attached:

Match the class to your own skill ceiling, not to the crowd — the real per-report premium lives in RCE and ATO precisely because they're genuinely hard, and pretending otherwise just moves you straight into the $1,081 tier with everyone else. Watch conversion rates while building a habit: GraphQL's 35% means real feedback, and feedback compounds over time. And remember the floor sitting under all of it — the same Critical-severity reports that paid $0 in the fame section above would have paid real money on any program where the checkbook was actually open. Class choice sets your ceiling. Program choice decides whether that ceiling exists at all.

The crowd hunts the bug with the biggest pot and the worst individual slices, seven times harder than it hunts the best-paying class on the entire board. The $35,000 password reset and the $33,510 archive validator are both sitting at the quiet end of the dataset, waiting for whoever eventually learns to reach them.

Two earlier pieces in this series dig deeper into two of the classes referenced above:

The SQL Injection Money Ladder — the full breakdown of the $25,000 Valve ceiling mentioned in the SQLi section, rung by rung, with a free lab for each step.
I Ranked 252 Disclosed IDOR Reports by Bounty — the program-floor lesson in full: why severity alone rarely predicts payout.

Sources

Dataset: reddelexc/hackerone-reports — per-bug-type disclosed lists for eleven types; all 4,590 entries parsed for report counts, paid counts, and bounty totals. Method: TOP*.md lists per type; "paid" defined as any non-zero listed bounty; averages computed over paid reports only.
Headline reports verified via live JSON (severity, bounty):

#1609965 GitLab RCE — Critical 9.9, $33,510.

#2293343 ATO via password reset — Critical 10.0, $35,000.

#510152 PayPal stored XSS — High 8.7, $20,000.

#591295 Twitter VPN pre-auth RCE — Critical, $20,160.

#489146 HackerOne GraphQL — Critical 9.3, $0.

#531051 Starbucks SQLi — Critical 9.3, $0.

Fame-vs-money rank-1 entries from the dataset lists: Steam Client RCE #470520, Lyft SSRF #885975, Reverb race #759247, Shopify OAuth #740989 (some pages may require login; figures sourced from the dataset directly).

Contents