> ./enumerate --scope
Pick a target
Receive a private invitation, read the assignment scope, and choose where your skills hit hardest. Web, API, mobile, network — everything is in play.
01> initializing secure uplink...
HACK. REPORT. EARN.
REST-API connects elite security researchers with organizations that want to be hacked — before the bad guys do it. Find vulnerabilities in APIs, web apps and infrastructure, and get paid for every valid report.
$ ./rest-api --start --scope=all --payout=max
0
active researchers
0
bounties paid
0
live programs
0
triage in 24h
// how it works
From recon to reward
in three commands
> ./exploit --report
Hunt & report
Find the vulnerability, write a clear proof-of-concept, and submit through our encrypted pipeline. Every report is triaged within 24 hours.
02> ./payout --confirm
Get paid
Valid findings are scored by severity and paid out fast. Climb the leaderboard, build reputation, and unlock private invites.
03> trusted_by --region=NL
All gift card providers in the Netherlands are our clients
Intersolve B.V.
SVS · storedvalue.com
Loyalty in a Box
Blackhawk NL
POSA Lifecycle
FC Card Solutions
giftcards.group
VVV / Primera
// private access only
Invitation-only hunting,
fully authorized
> cat /policy/access.conf
Private programs only
REST-API runs no public programs. Every target is a private, invitation-only assignment. You only hunt what you have been explicitly cleared to hunt.
> cat /policy/scope.conf
Scoped & authorized
Every assignment defines its own written scope. Web, API, mobile and network testing are typically authorized; social engineering only when explicitly included in the assignment — all covered by our safe-harbor agreement.
> ./assign --new
Unique secret code
Each assignment is issued with a unique secret_code that identifies your mission. Include it in every request header and report to prove authorization.
secret_code
RAPI-9F3K-7QX2-MD41
// live programs
Choose your battlefield
Acme Cloud
CRITICALapi.acmecloud.io · *.acmecloud.io
$500 — $25,000
→
Finex Pay
CRITICALpayments.finex.com · sandbox
$1,000 — $50,000
→
NovaBank
HIGHweb + mobile · oauth flows
$300 — $12,000
→
Orbit SaaS
HIGHapp.orbit.dev · graphql endpoint
$250 — $10,000
→
MedSecure
MEDIUMportal.medsecure.health
$100 — $5,000
→
Volt Motors
MEDIUMfleet API · OTA updates
$150 — $8,000
→
// leaderboard
Top hunters this quarter
| # | Handle | Reputation | Valid Bugs | Earnings |
|---|---|---|---|---|
| 01 | Tashfeen | 9,975 | 152 | $196,400 |
| 02 | 0xphantom | 9,842 | 147 | $184,300 |
| 03 | null_pointer | 9,110 | 132 | $161,750 |
| 04 | segfault | 8,640 | 118 | $142,020 |
| 05 | root_asha | 8,055 | 104 | $118,900 |
// hall of fame
Recently disclosed
Authentication bypass via JWT alg confusion
IDOR in payment history endpoint exposes full ledger
SSRF through webhook validator reaches internal metadata
// ready?
The next critical bug
has your name on it.
> no credit card. no noise. just bugs.