Centers for Medicare & Medicaid Services - Public Bug Bounty Program 2026
Centers for Medicare & Medicaid Services - Public Bug Bounty Program 2026 · Bugcrowd · launch date not exposed by platform
High competitionWeb
Live public bug bounty program on Bugcrowd with full safe harbor. Max payout $7,000.
Metrics
Bounty range$0 – $7.0k
Paid this month$0
Reports0/mo
Hunters0
Beginner fit
74/100
Estimated: this program accepts low-severity findings worth reporting.
Time to triage3d
Time to first bounty21d
Activity metrics for this program aren't exposed by the platform API, so the scores above are conservative estimates. Always verify on the program page before submitting.
Engage
Open on BugcrowdAlways read the full policy on the platform before submitting. Scope below is a summary only.
Scope assets11
Bounty floor$0
In-scope assets
- ██████████████████████
- ███████████████████████
- ████████████████████
- ███████████████████████████████████████████
- ████████████████
- ███████████████████
- ███████████████████████████
- █████████████████
- ██████████████████████
- ██████████████████████████████
- ████████████████████████████
Wanted categories
General
Who should hunt here
Beginners
Workable- 11 assets in scope gives you room to explore without fighting a crowd for the same endpoints.
- Wide attack surface — 11 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
- Fast feedback — triage lands in ~3 days, so you learn what this team pays for quickly.
Intermediate
Good target- Real ceilings — payouts reach $7.0k, so chaining two medium findings into one report actually pays.
Pros
High value- $7.0k ceiling — worth deep recon and targeted fuzzing; one critical here outearns a month of small programs.
- 11 assets scale well with automation — attack-surface monitoring and diffing pay off at this size.
Think twice if
- Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
- Bugcrowd doesn't publish report volume — the competition and fit scores here are conservative estimates, not measurements.
- Program age is unknown — Bugcrowd doesn't expose start dates, so "freshness" can't be verified.
Where these numbers come from
Live from Bugcrowd
- Max payout & safe-harbor status — from the hourly public Bugcrowd crawl
- Full in-scope asset list — crawled from Bugcrowd's public program
Modeled estimates
- Minimum bounty — not exposed; assumed $0 floor
- Report volume — unknown; competition is scored from neutral defaults
- Triage & payout speed — modeled, not measured
- Beginner fit — computed from the signals above (methodology on this page)