Where penetration testers and bug bounty researchers publish real work, and build a reputation that proves it.
PentestingHere is a community for security researchers. Publish findings, write up how you found them, share the resources you actually use, and read honest reviews of the programs worth your time, ranked by reputation recomputed from your published work, never self-reported.
Everything a researcher needs, in one place
Learn one vulnerability class at a time
Then break it yourself, in a hands-on lab that runs in your browser. Free, no setup.
One feed, not a directory
Your home page is a live stream of what the community publishes, and the people you follow shape what you see first.
Everything in one stream
Findings, writeups and resources from the whole community, newest first, in one list instead of three boxes.
Follow, and the feed changes
Follow a researcher and their recent work floats to the top of yours, under a label that says why it is there.
Act without leaving the page
Love a finding, save a writeup, follow the person who wrote it, all from the post itself.
Three steps, no gatekeeping
Create a free account
Sign up in seconds. Everything public is already readable with no account at all.
Verify to unlock publishing
A confirmed email, an authenticator app, or a linked Google or GitHub account: pick one.
Publish and build reputation
Findings, writeups and resources earn reputation from real, recomputed points, ranked on the leaderboard.
Nothing decorative looks like a credential
Three marks on a profile, three different claims, each earned a different way.
Verified
A real second factor: confirmed email, an authenticator app, or a linked Google or GitHub account. Required to publish.
Trusted
A moderator vouched for this researcher by hand. The one mark a threshold can never grant on its own.
Notable
500 followers, earned from published work people actually followed for.
What makes it worth using
- You control disclosure Targets can be public, anonymised or fully redacted, per finding.
- Your profile is your portfolio Statistics come from real platform data, never self-reported.
- Verified, not emailed An authenticator app, a confirmed email, or your Google or GitHub sign-in: never just a phone number.
- Writeups are conversations Readers ask questions; authors answer them in place.
Common questions
Is it free?
Yes. Creating an account, publishing findings, writeups and resources, and reading everything public costs nothing.
What do I see after I sign in?
Your home page becomes one feed: findings, writeups and resources from the whole community, newest first, with recent work by the researchers you follow on top. You can love, save and follow from the feed itself.
Do I need an invite?
No, registration is open. You don't even need to verify anything to sign up and read: verification only unlocks publishing.
What does "Verified" mean?
A real second factor: a confirmed email, an authenticator app, or a linked Google or GitHub account. Required to publish, and it is separate from "Trusted" (a moderator vouches by hand) and "Notable" (500 followers).
Can I keep a finding's target private?
Yes, per finding: public, anonymised, or fully redacted. That choice is enforced wherever the finding is read, not just hidden in the page.
How is reputation calculated?
From your own published, public work: findings weighted by severity, writeups, resources, reviews, recomputed from the real rows, never a counter that can drift.
Is my content moderated?
Yes. Reports go to a staff queue, and hiding content is reversible: you can see and edit your own hidden work, and editing it is how you appeal.
Start with one finding, one writeup, or one resource.
Reputation here is computed from what you publish, not what you claim.