Profile· Neutral@cantinasecurity On Ethos

Cantina 🪐

1 review, not positive.0% positive · 1 review· Influence factor 24, above 5% of accounts

The record

From 1 activities · Jun 2026

Cantina lacks published SLAs for bug bounty programs, creating uncertainty around report acknowledgment, review, and payout timelines. Researchers report that projects on the platform have failed to pay out bounties and shipped silent fixes without communication.

What people say

Received · 1 Given · 0

“Bad state of the platform - broken SLAs, lack of information, refusal to communicate”Cantina is one of the only bug bounty platforms that DO NOT have any SLAs listed for projects who have a bug bounty program with them. This leads to researches not being able to confirm when their report should be acknowledged, reviewed, paid out and leads to projects abusing the system by not paying out and shipping silent fixes. Here is my experience with Mezo and DYDX, who of the recent projects who listed with Cantina and broke just about every rule of any reasonable bug bounty program: https://x.com/v4rvl/status/2069865939722543462 In the comments you will see researches confirming the issues, showing their own cases where reports have not been paid for half a year and more. Only after the public post - we managed to get @everyone ping from Cantina, while they ignored the issue before and refused to communicate: https://x.com/v4rvl/status/2070198993137627554 They are supposedly looking into the issue. Regarding SLAs - the only project with SLA on Cantina is Injective - who has a TON of open disputes from their time with Immunefi, so that project is worth skipping. Example dispute: https://x.com/al_f4lc0n/status/2033110168045568434 I will re-rep once the situation improves. At the moment this is one of the worst platforms for security researches to hunt on unfortunately.

Vuk.Digital · 1288· 4mo ago · negative5

1 of 1 · most upvoted first