# Immunefi

> Immunefi is a crowdsourced web3 security platform running the largest onchain bug bounty
> ecosystem: protocols post bounties, security researchers submit vulnerabilities, and Immunefi
> triages, arbitrates and pays out. It also runs audit competitions and attackathons, PR reviews,
> Safe Harbor agreements, onchain monitoring, and Magnus, a unified security command center.
> Immunefi authors and versions the Immunefi Vulnerability Severity Classification System, the
> severity taxonomy most web3 bounty programs are written against.

Generated by API Evangelist from probed and searched public sources on 2026-08-23.
Immunefi does not publish an llms.txt of its own (https://immunefi.com/llms.txt returns 404).
This file is API Evangelist's third-party summary, not an Immunefi document.

## The one public API

Immunefi publishes exactly one machine-readable, unauthenticated endpoint:

- [Bug bounty programs catalog](https://immunefi.com/public-api/bounties.json): GET, no
  credentials, `application/json`. Returns the ENTIRE catalog as one top-level JSON array —
  249 programs / 6,498,795 bytes as measured 2026-08-23. There is no filtering, no pagination,
  no cursor, and no per-program path. Route confirmed by `x-matched-path: /public-api/bounties.json`.

How to consume it efficiently:

- Poll with `If-None-Match` carrying the weak ETag, e.g.
  `W/"2026-08-23T13:16:25.282Z:249:249"`. Verified: returns `304` with a zero-byte body when
  unchanged. The ETag encodes the last-modified timestamp AND the record count, so a catalog
  change is detectable from the header string alone without re-downloading 6.5MB.
- `HEAD` returns 200 and `OPTIONS` returns 204.
- No CORS headers are returned, so this cannot be called from browser JavaScript on another
  origin. Use a server-side or agent-side fetch.
- No rate limits are documented and no rate-limit headers of any family are returned.
- Errors are NOT machine-readable: an unmatched path returns `404` with `text/html` (a Next.js
  error page, ~80KB), never `application/problem+json`. Branch on status and Content-Type, not
  on the body.

## Response shape

Each array element is a bounty program. Full derived entity graph:
[data-model/immunefi-data-model.yml](data-model/immunefi-data-model.yml).
A real captured record: [examples/immunefi-bounty-program-example.json](examples/immunefi-bounty-program-example.json).

Key fields: `project`, `slug` (resolves to `https://immunefi.com/bug-bounty/<slug>/`),
`maxBounty`, `rewardsToken`, `launchDate`, `updatedDate`, `isPaused`, `inviteOnly`, `kyc`,
`immunefiStandard`, `ecosystem[]`, `language[]`, `programType[]`, `projectType[]`,
`productType[]`, plus four nested collections:

- `assets[]` — in-scope targets (6,984 observed). `type` is one of `smart_contract`,
  `blockchain_dlt`, `websites_and_applications`. Carries `isSafeHarbor` per asset.
- `rewards[]` — payout rules (1,096 observed). `severity` is `critical|high|medium|low`;
  `rewardModel` is `range|fixed|up_to`; amounts in `minReward`/`maxReward`/`fixedReward`.
- `impacts[]` — in-scope vulnerability impact statements (4,067 observed), same severity enum.
- `audits[]` — prior third-party audits (`auditor`, `date`, `url`).

The severity enum is not vendor-private — it is the Immunefi Vulnerability Severity
Classification System serialized into the contract. See
[conformance/immunefi-conformance.yml](conformance/immunefi-conformance.yml).

## What Immunefi does NOT publish

Recorded so an agent does not go looking:

- No OpenAPI, Swagger, GraphQL SDL, AsyncAPI, Protobuf or WSDL anywhere. Probed on
  immunefi.com, bugs.immunefi.com and docs.immunefi.foundation.
- No API reference or developer portal. `/docs/`, `/developers/`, `/api/` all return 404.
- No `.well-known` surface. Every `/.well-known/*` path on immunefi.com — including a nonsense
  control path — returns a `308` redirect to itself. No security.txt, no OIDC discovery, no
  agent card.
- No MCP server, no A2A agent card, no agent skills.
- No first-party SDK or CLI in any registry. The `immunefi-team` GitHub org (38 repos) holds
  Solidity proof-of-concepts and the Vaults contracts, not client libraries.
- No status page (`status.immunefi.com` does not resolve), no changelog, no roadmap, no
  deprecation or versioning policy, no SLA.
- No pricing. Protocol onboarding is a contact-sales motion.

## Standards and severity

- [Severity Classification Systems index](https://immunefi.com/severity-classification-systems/)
- [Vulnerability Severity Classification System v2.3](https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-3/)
  — prior versions v2.2, v2.1, v2 and v1.2 all remain live at their own URLs, because a program
  signed against an older version is still governed by it.
- [Safe Harbor](https://immunefi.com/safe-harbor/)

## Security

- [Immunefi's own bug bounty](https://immunefi.com/bug-bounty/immunefi/) — live since 2020-12-02,
  up to $50,000 USDC, KYC required, Safe Harbor signed, managed triage and arbitration.
- No `security.txt` is served (the `.well-known` redirect loop above).
- Domain posture (probed 2026-08-23): TLS 1.3, HSTS `max-age=15552000; includeSubDomains; preload`,
  CAA records present, SPF `-all`, DMARC `p=reject`. DNSSEC is not enabled.

## Site

- [Home](https://immunefi.com/)
- [Explore bug bounties](https://immunefi.com/bug-bounty/)
- [Audit competitions](https://immunefi.com/audit-competition/)
- [Boost](https://immunefi.com/boost/)
- [Vaults](https://immunefi.com/vaults/)
- [For projects](https://immunefi.com/projects/)
- [For researchers](https://immunefi.com/hackers/)
- [Learn](https://immunefi.com/learn/)
- [Blog](https://immunefi.com/blog/) ([RSS](https://immunefi.com/blog/feed))
- [Researcher application](https://bugs.immunefi.com/)
- [Support](https://immunefisupport.zendesk.com/hc/en-us) — behind a Cloudflare bot challenge for
  automated clients; reachable in a browser.
- [GitHub](https://github.com/immunefi-team)
- [Terms of Use](https://immunefi.com/terms-of-use/) · [Privacy Policy](https://immunefi.com/privacy-policy/)