IDOR

Where every good bug bounty career begins.

Reflected XSS

Quick payouts, quicker patches.

Stored XSS

The gift that keeps on giving.

CSRF

Convince the browser to do your dirty work.

SQL Injection

A classic for a reason.

SSRF

Make the server fetch you a bigger paycheck.

Auth Bypass

Who needs a password anyway.

RCE

The big leagues. The big payouts.

Supply Chain Compromise

Why attack the app when you can attack what it imports.

Cloud Misconfiguration

Somebody left a bucket open. Somebody always does.

11 Auto-Buyer Tools

From a $150 SQLMap license up to a $1B Autonomous Red Team AI, each tool automates a slice of the grind with an exponential pricing curve.

Nuclei Templates

The one tool whose output isn't flat: it gains 15% for every vulnerability class you have ever discovered, up to 2.35x with all nine. Going wide finally pays for itself.

Upgrades

Standalone upgrades multiply click or per-tool output once their unlock condition is met.

Auto-Clicker

A purchasable macro with selectable speed tiers - a genuine CPU/heat tradeoff, not a strictly-better-faster button.

4 Program Tiers

Unlock bigger targets as your career advances - from Indie Startup up to Gov/Defense contracts paying up to 15x the base bounty, with defenses that scale to match.

Motherboard Tiers

Permanent rig upgrades that raise your hardware ceiling across every future engagement.

Hardware Degradation

Push your rig hard enough and components wear down for real - repair or upgrade to keep pace.

RAM / CPU / Cooling Store

Spend in-engagement reputation on the hardware that keeps a growing tool fleet from cooking itself.

Heat Broker

Offload found bugs at a discount to cool down fast when the overload clock is against you.

"Go Full-Time" Prestige

Reset your run for a permanent income multiplier and start climbing again, faster.

Your Own Security Firm

Hire and level up Junior Hunters, collect Contract Fees every engagement, and spend them on upgrades only the firm can buy.

55 Achievements

Career milestones, marathon runs, and hidden terminal-secret unlocks - many grant permanent income and click bonuses, synced to Steam.

Heat System

Push too hard and your CPU overloads - manage the tradeoff.

Offline Progress

Keep earning while you're away - no time limit, just a lower rate than being at the keyboard.

Critical Bug Events

Rare "golden cookie"-style events for a burst of bonus payout or a frenzy window.

Combo & Frenzy Multipliers

Chain your hacks for escalating rewards.

Inbox

A recurring cast actually writes to you - clients, rivals, compliance, and more, mid-engagement.

Live Incidents

DDoS waves, CVE Drop Days, and compliance audits temporarily change the rules while they're active.

Phishing Awareness Minigame

Spot the tell in a suspicious email - real, spottable details, not a coin flip.

Daily Contracts

A streak-tracked reason to come back tomorrow, with its own reward ladder.

Anonymous Tip

Rarely, a chip with a shifting rainbow glow scrolls past in the findings ticker. Click it before it disappears and one lead cascades into a burst of findings, including a vulnerability class you have never seen before.

greylist.exe

A tripwire-dodging network-scan puzzle, with a Red Team difficulty for the truly unhinged.

worm.sh

An arcade-style infection-spreading romp across a live network.

waf-buster.exe

Race the clock past a web application firewall for a payout.

proxychain.sh

Stand up relay hops to route your traffic to a target host before the trace catches up. You place whatever the queue hands you, with no skipping, and a longer route than you strictly needed pays better.

Secure Code Reviews

A code-review mini-game - spot the vulnerable line before you ship the fix.

Incident Response Tabletops

Remote-style video tabletop simulations with NPC stakeholders - talk your way through a live incident, not just click through it.

Engagement Report Readouts

Every engagement wraps with a pentest-report-style readout of what you found and what it paid.

Career Tracking

Review your history of past engagement reports as your career (and reputation) builds up.

Vuln Wiki

An in-game wiki covering each vulnerability class for real - doubles as an actual AppSec training reference, not just flavor text.

A Recurring Cast

A CISO client, a rival bounty hunter, an automated response bot, a compliance officer, and a local agent living on your own rig - all with their own running commentary.

Slash Commands

The terminal input supports slash commands (/xss, /stats, /help, and more) with Tab-autocomplete.

Hidden Terminal Easter Eggs

Well over a dozen discoverable secrets reward players who type things nobody told them to.

24 Desktop Windows

A fully draggable, resizable hacker desktop - Terminal, htop-style monitor, apt package manager, tools manager, animated browser/scan canvas, inbox, hardware store, and more.

Music Player

An in-game player with 11 original tracks to soundtrack the grind, plus two more you have to earn.

Themes, Wallpapers & Effects

Recolour the whole desktop, pick a wallpaper, and layer on a live background effect - matrix rain, pulse waves, a rain storm, or a radar sweeping for live findings.