# HackerOne Programs Scraper (`automation-lab/hackerone-programs-scraper`) Actor

Extract public HackerOne bug bounty program data, bounty ranges, submission status, response metrics, and policy URLs for OSINT and sales.

- **URL**: https://apify.com/automation-lab/hackerone-programs-scraper.md
- **Developed by:** [Stas Persiianenko](https://apify.com/automation-lab) (community)
- **Categories:** Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## HackerOne Programs Scraper

Extract public HackerOne bug bounty and vulnerability disclosure program data from the HackerOne directory.

Use it to monitor program launches, bounty ranges, public response metrics, submission status, and policy URLs without logging in.

### What does HackerOne Programs Scraper do?

HackerOne Programs Scraper collects public program records from `hackerone.com/directory/programs`.

It uses the same public GraphQL data source that powers the HackerOne directory.

The actor returns one dataset row per public program.

Each row includes identity, URLs, status, bounty metadata, and public program metrics.

It does not access private reports.

It does not submit vulnerabilities.

It does not require HackerOne credentials.

### Who is it for?

Security sales teams use it to find companies running active disclosure or bounty programs.

Compliance teams use it to monitor vendor security maturity signals.

OSINT analysts use it to build a public bug bounty intelligence dataset.

Bug bounty researchers use it to discover newly launched programs.

Partnership teams use it to enrich account lists with HackerOne program status.

### Why use this actor?

HackerOne's directory is useful, but manual checking is slow.

This actor turns the directory into structured data.

You can export to JSON, CSV, Excel, Google Sheets, BigQuery, or your CRM.

You can run it on a schedule to detect new programs.

You can target exact handles when you only need known companies.

### Data you can extract

| Field | Description |
| --- | --- |
| `handle` | HackerOne program handle |
| `name` | Public program name |
| `programUrl` | HackerOne program URL |
| `policyUrl` | Public policy/team URL |
| `submissionState` | Public submission state |
| `isAcceptingSubmissions` | Whether submissions are open |
| `triageActive` | Public triage flag |
| `resolvedReportCount` | Public resolved report count when available |
| `currency` | Bounty currency |
| `minimumBounty` | Public minimum bounty value |
| `averageBountyLower` | Lower public average bounty estimate |
| `averageBountyUpper` | Upper public average bounty estimate |
| `launchedAt` | Public launch timestamp |
| `scrapedAt` | Extraction timestamp |

### How much does it cost to scrape HackerOne programs?

This actor uses pay-per-event pricing.

There is a small start charge per run.

There is a per-program charge for each saved dataset item.

Use `maxItems` to control the run size.

The default input saves 20 programs for a cheap first run.

Large monitoring jobs can use Apify schedules and dataset exports.

### Input options

`maxItems` sets the maximum number of public programs to save.

`handles` accepts exact HackerOne handles or full program URLs.

`sortBy` controls the public directory order for broad scrapes. The stable public option is newest launches first.

`openOnly` keeps only programs accepting submissions.

`bountyOnly` keeps only programs with public bounty metadata.

### Example input

```json
{
  "maxItems": 100,
  "sortBy": "launched_at_desc",
  "openOnly": false,
  "bountyOnly": false
}
````

### Scrape exact HackerOne programs

Use `handles` when you already know the companies to check.

```json
{
  "handles": ["github", "anthropic-cyber-jailbreak"],
  "maxItems": 2
}
```

Handles can also be full URLs.

For example, `https://hackerone.com/github` is normalized to `github`.

### Output example

```json
{
  "handle": "anthropic-cyber-jailbreak",
  "name": "Anthropic Cyber Jailbreak",
  "programUrl": "https://hackerone.com/anthropic-cyber-jailbreak",
  "submissionState": "open",
  "isAcceptingSubmissions": true,
  "currency": "usd",
  "minimumBounty": null,
  "launchedAt": "2026-07-01T03:13:54.818Z"
}
```

### How to run

Open the actor on Apify.

Enter a maximum item count.

Optionally add specific HackerOne handles.

Choose filters.

Click Start.

Download the dataset when the run succeeds.

### Tips for best results

Use `launched_at_desc` to monitor new program launches.

Sort or filter by `resolvedReportCount` in your exported dataset when you need established programs with more public activity.

Use `bountyOnly` when you only need programs with public reward data.

Use exact handles for CRM or vendor enrichment.

Keep scheduled runs small if you only need daily deltas.

### Integrations

Send new program rows to Slack for security intelligence alerts.

Export bounty metadata to Google Sheets for manual review.

Sync program URLs to a CRM account enrichment workflow.

Load results into BigQuery for historical trend analysis.

Connect Apify webhooks to trigger downstream compliance checks.

### API usage

Run the actor from Node.js:

```js
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('automation-lab/hackerone-programs-scraper').call({
  maxItems: 100,
  sortBy: 'launched_at_desc'
});
console.log(run.defaultDatasetId);
```

Run the actor from Python:

```python
from apify_client import ApifyClient

client = ApifyClient('YOUR_APIFY_TOKEN')
run = client.actor('automation-lab/hackerone-programs-scraper').call({
    'maxItems': 100,
    'sortBy': 'launched_at_desc',
})
print(run['defaultDatasetId'])
```

Run the actor with cURL:

```bash
curl "https://api.apify.com/v2/acts/automation-lab~hackerone-programs-scraper/runs?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"maxItems":100,"sortBy":"launched_at_desc"}'
```

### MCP usage

Use this actor from Claude Code through Apify MCP.

MCP tool URL:

`https://mcp.apify.com/?tools=automation-lab/hackerone-programs-scraper`

Claude Code setup:

```bash
claude mcp add apify-hackerone-programs https://mcp.apify.com/?tools=automation-lab/hackerone-programs-scraper
```

Claude Desktop JSON config:

```json
{
  "mcpServers": {
    "apify-hackerone-programs": {
      "url": "https://mcp.apify.com/?tools=automation-lab/hackerone-programs-scraper"
    }
  }
}
```

Example prompt:

"Scrape the newest 100 HackerOne programs and summarize which ones accept submissions."

Another prompt:

"Check HackerOne handles github and anthropic-cyber-jailbreak and return bounty metadata."

### Scheduling

Create an Apify schedule to run the actor daily or weekly.

Use a low `maxItems` value for daily launch monitoring.

Use a larger value for monthly market snapshots.

Export only new rows in your downstream workflow if you need deltas.

### Legality and ethics

This actor extracts public directory data.

It does not bypass authentication.

It does not access private HackerOne reports.

It does not interact with vulnerability submission forms.

You are responsible for using exported data lawfully and respecting applicable terms.

### Troubleshooting

If a handle returns no row, confirm the program is public and the handle is correct.

If no bounty values appear, the program may not expose public bounty metadata.

If a run is slower with `bountyOnly`, the actor may need to scan additional directory pages to find matching programs.

If you need private program data, this actor is not the right tool.

### Related scrapers

Use other automation-lab security and OSINT actors to enrich vendor intelligence workflows.

For broader web enrichment, combine this actor with company website and contact discovery actors.

For link or compliance checks, export `programUrl` and `policyUrl` to downstream Apify actors.

### FAQ

#### Does this actor need a HackerOne login?

No.

It uses public program directory data only.

#### Can it scrape vulnerability reports?

No.

The actor intentionally excludes private reports and submissions.

#### Can I monitor new HackerOne programs?

Yes.

Run with `sortBy` set to `launched_at_desc` and schedule recurring runs.

#### Can I scrape only companies I care about?

Yes.

Put exact handles or HackerOne URLs in `handles`.

#### Why are some bounty fields null?

Not every public program exposes reward amounts in the directory.

Null values mean HackerOne did not expose that field publicly for the program.

### Changelog

Initial version extracts public HackerOne program directory rows, exact handles, sorting, and filters.

# Actor input Schema

## `maxItems` (type: `integer`):

Maximum number of public HackerOne programs to save.

## `handles` (type: `array`):

Optional exact HackerOne handles or program URLs. Leave empty to scrape the public directory.

## `sortBy` (type: `string`):

Public directory order. HackerOne's unauthenticated directory reliably supports newest launches first.

## `openOnly` (type: `boolean`):

Skip programs whose public submission state is not open.

## `bountyOnly` (type: `boolean`):

Skip programs that do not expose a base, minimum, or average bounty amount in the public directory.

## Actor input object example

```json
{
  "maxItems": 20,
  "handles": [
    "anthropic-cyber-jailbreak",
    "github"
  ],
  "sortBy": "launched_at_desc",
  "openOnly": false,
  "bountyOnly": false
}
```

# Actor output Schema

## `overview` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 20,
    "handles": [
        "anthropic-cyber-jailbreak",
        "github"
    ],
    "sortBy": "launched_at_desc",
    "openOnly": false,
    "bountyOnly": false
};

// Run the Actor and wait for it to finish
const run = await client.actor("automation-lab/hackerone-programs-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "maxItems": 20,
    "handles": [
        "anthropic-cyber-jailbreak",
        "github",
    ],
    "sortBy": "launched_at_desc",
    "openOnly": False,
    "bountyOnly": False,
}

# Run the Actor and wait for it to finish
run = client.actor("automation-lab/hackerone-programs-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 20,
  "handles": [
    "anthropic-cyber-jailbreak",
    "github"
  ],
  "sortBy": "launched_at_desc",
  "openOnly": false,
  "bountyOnly": false
}' |
apify call automation-lab/hackerone-programs-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=automation-lab/hackerone-programs-scraper",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "HackerOne Programs Scraper",
        "description": "Extract public HackerOne bug bounty program data, bounty ranges, submission status, response metrics, and policy URLs for OSINT and sales.",
        "version": "0.1",
        "x-build-id": "6Jkx9oKzaE079FbbG"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/automation-lab~hackerone-programs-scraper/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-automation-lab-hackerone-programs-scraper",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/automation-lab~hackerone-programs-scraper/runs": {
            "post": {
                "operationId": "runs-sync-automation-lab-hackerone-programs-scraper",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/automation-lab~hackerone-programs-scraper/run-sync": {
            "post": {
                "operationId": "run-sync-automation-lab-hackerone-programs-scraper",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "properties": {
                    "maxItems": {
                        "title": "Maximum programs",
                        "minimum": 1,
                        "maximum": 10000,
                        "type": "integer",
                        "description": "Maximum number of public HackerOne programs to save.",
                        "default": 20
                    },
                    "handles": {
                        "title": "Specific program handles or URLs",
                        "type": "array",
                        "description": "Optional exact HackerOne handles or program URLs. Leave empty to scrape the public directory.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "sortBy": {
                        "title": "Directory sort",
                        "enum": [
                            "launched_at_desc"
                        ],
                        "type": "string",
                        "description": "Public directory order. HackerOne's unauthenticated directory reliably supports newest launches first.",
                        "default": "launched_at_desc"
                    },
                    "openOnly": {
                        "title": "Only programs accepting submissions",
                        "type": "boolean",
                        "description": "Skip programs whose public submission state is not open.",
                        "default": false
                    },
                    "bountyOnly": {
                        "title": "Only programs with bounty metadata",
                        "type": "boolean",
                        "description": "Skip programs that do not expose a base, minimum, or average bounty amount in the public directory.",
                        "default": false
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```