Skip to main content

Find Bugs, Earn Sats

Help us build a better platform. Report bugs and earn satoshi rewards based on severity.

-- Open Reports

Bug bounty at a glance

Reward Tiers

Funds at risk 5,000 – 50,000 sats

A working way to take sats you are not owed, see or predict game outcomes, or take over another account

Critical 150 – 200 sats

Security vulnerabilities, fund loss, data exposure, authentication bypass

High 100 – 150 sats

Gameplay bugs affecting outcomes, incorrect payouts, broken core features

Medium 50 – 100 sats

UI glitches, broken flows, display errors, incorrect calculations

Low 25 – 50 sats

Typos, minor visual issues, cosmetic inconsistencies, small UX improvements

What qualifies for Funds at risk

  • Withdraw, spend or credit sats that were never deposited or won (double spends, balance not debited, payouts without a bet)
  • Learn or predict a game result before it settles (seed, card or outcome leaks)
  • Take over another user's account or move their funds

Requirements

  • Reproduce it on your own account
  • Report it privately through this form before telling anyone
  • Take no more than you need to prove it and give back any sats you got
  • First valid report wins

The amount within the range is set by how much it could have cost us and how easy it was to use. Paid after the fix ships.

Submit a Bug Report

Use the verified email on your LightningFaucet account. Rewards are credited to your account balance, so reports need an account to be payable.
Drag & drop images here or

Bug bounty questions

How much does the Lightning Faucet bug bounty pay?

Rewards are set by severity: Funds at risk 5000 to 50000, Critical 150 to 200, High 100 to 150, Medium 50 to 100, Low 25 to 50 sats, so 25 to 50,000 sats in total. The Funds at risk tier is only for findings clearly worth more than that to us, such as a way to take sats you are not owed. Among reports paid since mid-September 2026 the median was 50 sats and about 86% paid 100 sats or less.

What do I need to submit a bug report?

A short title, what happened, numbered steps to reproduce it, what you expected and what you saw, and screenshots. Use the verified email of your Lightning Faucet account, because the reward is credited to your account balance and a report without an account cannot be paid.

How long until a report is reviewed and paid?

Recent reports were resolved within 24 hours about 57% of the time and within 7 days about 72% of the time. Some take longer. A reward is credited to your balance once the report is confirmed.

What gets rejected?

Roughly one in four resolved reports in recent weeks was not paid. The usual reasons are a duplicate of an earlier report, a problem we could not reproduce from the details given, and behaviour that is intended rather than a bug. Clear steps and a screenshot make a report much more likely to be confirmed.

Can I withdraw bug bounty rewards without depositing?

Yes. Sats earned from bug bounties are withdrawable without a deposit. The minimum withdrawal is 100 sats, paid over Lightning to any compatible wallet.