How it works

Developers publish their app or website to the Mushi Bounties marketplace. They set a bounty schedule — how many mushi-points each severity of bug is worth.

You browse the marketplace, join an app, and use it as a real user. When you find something broken, you submit a report with steps to reproduce, expected vs actual behavior, and any screenshots.

The developer reviews your submission in their Mushi console. If it is accepted, your mushi-points balance increases immediately. If the developer marks it as a duplicate or not reproducible, you can see their feedback and improve your next report.

A report is accepted when the developer confirms they can reproduce the bug and that it was not previously known. Stronger reports include: clear steps to reproduce, a screen recording or annotated screenshot, the device or browser where you saw it, and the expected vs actual behavior.

Enhancement requests and feature ideas are also accepted by some developers at a lower point value.

Spam, duplicate reports, and reports about intentionally broken demo features are rejected. Repeated spam lowers your reputation score, which affects the point value of future accepted reports.

1,000 mushi-points = $10 as a gift card (at 1.0× face value) or $13 as Mushi Pro account credit (at a 1.3× premium).

Point values are set per app by the developer. A critical crash bug might be worth 2,500 points. A minor UI inconsistency might be worth 100. Developers can also award discretionary bonus points for exceptionally clear or high-impact reports.

There is no subscription or fee to participate as a tester. You earn points by contributing, not by paying.

To comply with US tax regulations, we are required to collect tax identification information from testers who receive more than $599 in gift cards in a calendar year.

When your cumulative gift card redemptions approach this threshold, you will see a notice on your wallet page asking you to complete a brief KYC form — providing your legal name, jurisdiction, and a tax ID number (W-9 for US persons, W-8BEN for non-US persons).

Until KYC is cleared, additional gift card redemptions above the threshold are held. Mushi Pro credit redemptions are not subject to the KYC gate since they are not taxable income — they are treated as a platform credit.

Your raw TIN is hashed client-side before it is sent to our servers. We do not store or log your unencrypted tax ID.

Every tester has a reputation score that starts neutral. Accepted reports improve your score. Rejected reports for spam or dishonest testing lower it.

Your reputation score affects a multiplier on your point awards. Testers with a strong track record of high-signal reports earn a bonus. Testers who send spam or inflate reports face a penalty.

We also enforce velocity caps: submitting more than a certain number of reports per hour or per day flags your account for manual review. This protects developers from being flooded with low-quality reports.

Mushi Bounties is not available in jurisdictions subject to US OFAC sanctions, including Cuba, Iran, North Korea, Russia (payment services), Syria, and the Crimea/Donetsk/Luhansk regions.

If your account is associated with a restricted region, gift card and Pro credit redemptions will be declined. You can still browse the marketplace and submit reports, but payouts are blocked.

If you believe your region was incorrectly flagged, contact support with proof of your location. We review appeals within 5 business days.