Bug Bounty Program Scope Tracker Scraper

Scrape public bug-bounty program scopes from HackerOne, Bugcrowd, Intigriti, and YesWeHack. Returns normalized in-scope and out-of-scope asset lists, bounty ranges, and response-time stats for roughly 800+ public programs across all four platforms, with run-over-run scope-change detection built in.

---

Bug Bounty Program Scope Tracker Features

• Unifies four platforms into one schema — no more juggling separate HackerOne, Bugcrowd, Intigriti, and YesWeHack exports.
• Flags scope_change_detected on every record, comparing this run's in-scope/out-of-scope assets against the last time you ran the actor for that program.
• Returns structured asset arrays, not prose. Each in-scope and out-of-scope entry carries its target, asset type, bounty eligibility, and any hunter instructions.
• Filters to bounty-paying programs only with a single toggle.
• Pure API scraping — no browser, no proxies, no anti-bot handling. It reads a public, daily-refreshed data aggregate.
• Captures published bounty ranges where the platform discloses them — Bugcrowd (max only), Intigriti and YesWeHack (min and max).

---

Who Uses Bug Bounty Scope Data?

• Security researchers — build a personal target list filtered by asset type, payout range, or platform, instead of tab-hopping four separate program directories.
• ASM and attack-surface vendors — seed asset-discovery pipelines with a machine-readable feed of what's actually in scope, refreshed on your schedule.
• Bug bounty triage teams — monitor scope drift on programs you track, and get notified (via scope_change_detected) the moment a company adds or removes an asset.
• Security researchers doing due diligence — check whether a target domain is currently in scope before spending time on it, or whether it moved to out-of-scope.

---

How Bug Bounty Program Scope Tracker Works

1. Pick which platforms to include — HackerOne, Bugcrowd, Intigriti, YesWeHack, or any combination.
2. The actor fetches each platform's public scope aggregate and normalizes every program into one schema, regardless of how that platform structures its own scope data.
3. Each program's current in-scope/out-of-scope hash is compared against the value stored from your last run, so scope_change_detected tells you exactly which programs moved.
4. Results land in your dataset as one row per program, with in_scope and out_of_scope as arrays of JSON-string assets you can parse directly.

---

Input

{
  "platforms": ["hackerone", "bugcrowd", "intigriti", "yeswehack"],
  "offersBountiesOnly": false,
  "maxItems": 15
}

Field	Type	Default	Description
platforms	array	["hackerone","bugcrowd","intigriti","yeswehack"]	Which bug-bounty platforms to include in this run.
offersBountiesOnly	boolean	false	When enabled, skip programs that don't pay bounties (swag-only / VDP-only programs).
maxItems	integer	15	Maximum number of programs to return, across all selected platforms combined. Raise this to pull the full set — HackerOne alone runs 450+ public programs.

Restrict to a single platform:

{
  "platforms": ["hackerone"],
  "offersBountiesOnly": true,
  "maxItems": 100
}

---

Bug Bounty Program Scope Tracker Output Fields

{
  "platform": "hackerone",
  "program_handle": "agoda-public",
  "program_name": "Agoda Public",
  "program_url": "https://hackerone.com/agoda-public",
  "offers_bounties": true,
  "offers_swag": false,
  "managed_program": true,
  "bounty_min_usd": null,
  "bounty_max_usd": null,
  "average_time_to_first_response": "0",
  "average_time_to_bounty_awarded": null,
  "in_scope": [
    "{\"target\":\"https://www.agoda.com/book/\",\"type\":\"URL\",\"eligible_for_bounty\":true,\"instruction\":null}"
  ],
  "out_of_scope": [],
  "asset_types": ["URL"],
  "policy_url": "https://hackerone.com/agoda-public",
  "launched_at": null,
  "scope_change_detected": true,
  "scraped_at": "2026-07-13T09:34:22.224Z"
}

Field	Type	Description
platform	string	Source platform: hackerone, bugcrowd, intigriti, or yeswehack.
program_handle	string	Program handle or slug on its platform.
program_name	string	Program display name.
program_url	string	Program page URL on its platform.
offers_bounties	boolean	Whether the program pays monetary bounties.
offers_swag	boolean	Whether the program offers swag rewards (HackerOne only; null on other platforms).
managed_program	boolean	Whether the platform actively triages and manages the program.
bounty_min_usd	number	Published minimum bounty, in the platform's native currency — not every platform is USD-denominated (Intigriti and YesWeHack often publish in EUR).
bounty_max_usd	number	Published maximum bounty, same currency caveat as above.
average_time_to_first_response	string	Average time to first program response, where published.
average_time_to_bounty_awarded	string	Average time to bounty awarded, where published.
in_scope	array of strings	In-scope assets. Each entry is a JSON string: {target, type, eligible_for_bounty, instruction}.
out_of_scope	array of strings	Out-of-scope assets, same shape as in_scope.
asset_types	array of strings	Distinct asset types in this program's scope — url, wildcard, api, android, ios, cidr, source_code, other, and platform-specific variants.
policy_url	string	Program policy or detail page URL.
launched_at	string	Program launch date, where published.
scope_change_detected	boolean	true when this run's scope differs from the last run's stored snapshot for this program (or this is the first time you've scraped it).
scraped_at	string	ISO 8601 timestamp this record was scraped.

---

FAQ

How do I scrape bug bounty program scopes?

Bug Bounty Program Scope Tracker Scraper reads the public bounty-targets-data aggregate — a daily-refreshed, community-maintained mirror of every public HackerOne, Bugcrowd, Intigriti, and YesWeHack program's own scope pages. Run the actor with your preferred platforms filter and it returns one normalized row per program.

How much does Bug Bounty Program Scope Tracker Scraper cost to run?

It's billed per record on the standard Apify PPE model — a per-start fee plus a small per-record charge. There's no proxy or browser overhead, so cost stays low and predictable regardless of platform mix.

What data can I get from bug bounty programs?

In-scope and out-of-scope asset lists, bounty ranges (where published), response-time stats, and whether a program is actively managed or bounty-paying. It's the scope metadata programs publish, not target reconnaissance.

Can I filter by platform?

Yes. Pass any subset of hackerone, bugcrowd, intigriti, yeswehack in platforms. Omit the field and you get all four.

Does Bug Bounty Program Scope Tracker Scraper need proxies?

No. It reads a public GitHub-hosted JSON aggregate, not the platforms directly — no proxy, no browser, no anti-bot handling required.

How does scope-change detection work?

Bug Bounty Program Scope Tracker Scraper hashes each program's normalized in-scope/out-of-scope arrays and compares that hash against the value stored from your previous run. If it's different (or this is the first run), scope_change_detected comes back true.

---

Need More Features?

Need custom fields, filters, or a different target site? File an issue or get in touch.

Why Use Bug Bounty Program Scope Tracker Scraper?

• Four platforms, one schema — HackerOne, Bugcrowd, Intigriti, and YesWeHack normalized into the same fields, so you're not writing four parsers.
• Built-in scope-change detection — every record tells you whether that program's scope moved since your last run, which is the one thing none of the single-platform alternatives track.
• Cheap and fast — no browser, no proxies, just a structured public data aggregate turned into clean rows.