🐛 Bug Bounty Finder: HackerOne and Bugcrowd Programs as Flat Data

Find every public bug bounty program for a company before you start hunting One search checks HackerOne, Bugcrowd, and the company's own security contact file, then hands back a flat spreadsheet row for each program or contact it finds.

🔎 Three sources, one run Checks HackerOne, Bugcrowd, and the company's security contact file together, not one at a time.

📭 Never comes back empty No formal bounty program? You still get the company's published security contact when it has one.

📋 One flat row per finding Every result lands as a single ready-to-filter row. No nested data to unpack.

💵 Bounty numbers up front Minimum and maximum payouts, currency, and resolved report counts sit right in the row.

Paste in a company name or domain and get back every public bug bounty program it runs on HackerOne and Bugcrowd, plus its published security contact, in one pass.

🔍 What does Bug Bounty Finder do?

Bug Bounty Finder takes one company name or domain and checks three public sources for it: the HackerOne program directory, the Bugcrowd engagements directory, and the company's own security.txt file (the standard, published security contact format most companies host at a predictable web address). It combines whatever it finds into one flat, spreadsheet-ready table: no nested objects, no lists inside cells.

If the company runs a paying bug bounty program, you get the program name, minimum and maximum bounty, currency, resolved report count, and a link to its policy. If it doesn't, you still get its published security contact, encryption key, hiring page, and acknowledgments page when the company has them, so a "no program" result still gives you a way to report responsibly.

💡 Why use Bug Bounty Finder?

You're a bug bounty hunter picking a target. Before you spend a weekend testing a company, run one search to see whether it has a paying program, what it pays, and how many reports have already been resolved there.

You're reviewing a vendor or acquisition target. Confirm in one pass whether the company runs a public responsible-disclosure program, or at minimum has a real security contact on file, instead of checking three sites by hand.

You're doing outreach to security teams. Pull a company's bounty range and security contact together so you know who to talk to and what they already pay for reports.

🚀 How to use Bug Bounty Finder?

STEP 1 Enter a company Type a brand name (like `uber`) or a full domain (like `github.com`).

STEP 2 Pick your sources Choose HackerOne, Bugcrowd, security.txt, or all three.

STEP 3 Get a flat dataset Download one row per program or security contact, ready for a spreadsheet.

Set maxItems to cap how many rows you want and onlyWithBounty to skip programs that don't pay cash.

📥 Input parameters

Field	Type	Required	Description
query	string	Yes	The company name or domain to search for, such as uber or github.com.
platforms	array	No	Which sources to check: hackerone, bugcrowd, security_txt, or any combination.
onlyWithBounty	boolean	No	When enabled, skip programs that don't pay a cash bounty.
maxItems	integer	No	The maximum number of rows to return.
proxyConfiguration	object	No	Proxy settings for the run. Apify Proxy is enabled by default.

📤 Output dataset structure

Every result is one flat row. Program rows and security contact rows share the same table, so you can filter either out with has_program or has_security_txt.

Example program row

{
  "query": "uber",
  "target_name": "Uber",
  "has_program": true,
  "program_platform": "hackerone",
  "program_name": "Uber",
  "program_url": "https://hackerone.com/uber",
  "min_bounty": 100,
  "max_bounty": 15000,
  "currency": "USD",
  "offers_bounties": true,
  "resolved_reports": 2450,
  "policy_snippet": "Uber's official vulnerability disclosure program on HackerOne.",
  "engagement_type": "public",
  "scraped_at": "2026-06-20T10:00:00.000Z"
}

Example security contact row

{
  "query": "uber",
  "target_name": "Uber",
  "has_security_txt": true,
  "security_txt_domain": "uber.com",
  "security_txt_contact": "mailto:security@uber.com",
  "security_txt_policy": "https://uber.com/legal/security-policy",
  "security_txt_encryption": "https://uber.com/pgp-key.asc",
  "security_txt_hiring": "https://uber.com/careers",
  "security_txt_acknowledgments": "https://uber.com/security/hall-of-fame",
  "security_txt_expires": "2026-12-31T23:59:59.000Z",
  "scraped_at": "2026-06-20T10:01:00.000Z"
}

📋 Mapped data fields

Field	Type	Description
query	string	The search term that produced this row.
target_name	string	The resolved company or brand name.
has_program	boolean	True if a bug bounty or disclosure program was found.
program_platform	string	Where the program was found: hackerone or bugcrowd.
program_name	string	The program's display name.
program_url	string	A direct link to the program's page.
min_bounty	number	The minimum published cash reward.
max_bounty	number	The maximum published cash reward.
currency	string	The bounty currency.
offers_bounties	boolean	True if the program pays cash rewards.
resolved_reports	number	The number of resolved reports the program has published.
policy_snippet	string	A short excerpt from the program's policy.
engagement_type	string	Whether the program is public or private.
has_security_txt	boolean	True if the domain publishes a security contact file.
security_txt_domain	string	The domain the security contact file was found on.
security_txt_contact	string	The published security contact (email or URL).
security_txt_policy	string	A link to the domain's disclosure policy.
security_txt_encryption	string	A link to the domain's public encryption key.
security_txt_hiring	string	A link to the domain's security hiring page.
security_txt_acknowledgments	string	A link to the domain's researcher acknowledgments page.
security_txt_expires	string	When the security contact file says it expires.
scraped_at	string	When this row was collected.

💰 Pricing

Bug Bounty Finder is pay per result. You pay for each program or security contact row returned, plus a small per-run fee. A search that finds nothing costs nothing beyond the run fee. There's no subscription and no minimum spend.

⭐ Enjoying Bug Bounty Finder?

⭐ ⭐ ⭐ ⭐ ⭐ Save the time it takes to check HackerOne, Bugcrowd, and security.txt one target at a time. A 5-star rating takes 10 seconds and helps other bug bounty hunters and security teams find it. Your feedback also tells us what to build next.

★  Rate this Actor on Apify

🛠️ Tips and optimization

• Broad brand search: Use a short brand term (like meta or microsoft) to match across HackerOne and Bugcrowd.
• Security contact only: Enter a full domain (like github.com) and select only security_txt if you just need a contact point.
• Control your cost: Use maxItems to cap how many rows a run can return.

🛡️ Support, disclaimers, and feedback

This tool aggregates publicly accessible disclosure directories and the open security.txt standard. It does not perform active vulnerability scanning or exploit attempts. It only queries public directories and public paths.

For bug reports, feature requests, or questions, use the Issues tab on the Apify platform.

🔗 Other actors

• SEC EDGAR Scraper for RAG: 10-K/10-Q/8-K as JSON ↗ - extracts SEC filings into RAG-ready chunks for compliance teams.
• CourtListener RAG extractor: legal opinions as searchable chunks ↗ - converts US court opinions into chunked JSON for legal research.
• RapidAPI Hub Scraper: API Listings, Metrics and Developer Data ↗ - pulls structured API listings from the RapidAPI Hub directory.
• HN Who is Hiring Scraper ↗ - collects tech hiring posts from Hacker News threads.
• Moz Domain Authority Scraper: Bulk DA & SEO Stats ↗ - pulls domain authority and SEO metrics for target domains.