5 free resources on this topic. Everything here is free and hand-picked. You can also search within this topic.
Personal site of software engineer and cybersecurity researcher Nisarga Adhikary, with his projects and writing.
Why I recommend it: A good example of a young researcher building a public track record. It is his own site, so achievements are self-described.
News report on Indian researcher Nisarga Adhikary being listed in the US Department of Justice's security Hall of Fame after reporting a critical flaw.
Why I recommend it: MSN republishes other outlets' stories, and the flaw details come from the researcher himself. I could not open the page, so I wrote this from the title — please check it.
Bugcrowd's library of security guides, ebooks, research reports and customer stories, including its Ultimate Guide to AI Security (2026) and Ultimate Guide to Red Teaming. A reasonable free way into how bug bounty and penetration testing programmes actually run.
Why I recommend it: Free, but several downloads ask for your work email and it is a vendor's marketing library, so the conclusion is usually that you need a bug bounty platform. Read it for the vocabulary and process, then check claims against a neutral source.
Anthropic's security and model-safety reporting program on HackerOne.
Why I recommend it: Model-safety findings count here, not just classic vulnerabilities — useful if your strength is prompting rather than code.
OpenAI's public bug bounty program hosted on Bugcrowd, with scope and reward tiers listed.
Why I recommend it: Read the scope twice before testing anything. Out-of-scope reports get closed and waste your reputation on the platform.
