Bug Bounty Programs Scraper

🛡️ Find Public Bug Bounty Programs

Security researchers, AppSec teams, and people learning bug hunting can use this Actor to find public bug-bounty and vulnerability-disclosure programs. It saves one normalized row for each first eligible program match, with the source, public links, rewards, scope, access details, status, and run history. Use the rows to choose public targets and review their published rules.

When the same program appears again from another search value, the Actor keeps the first saved match and ignores the later one. discoveredBy shows the one value that led to that first row.

• Search selected public sources for Bug Bounty Platforms records and compare their source, program type, and public links.
• Find public targets for a Bug Bounty Hunter by searching a keyword, company, domain, handle, or URL.
• Find public programs connected to Bug Bounty Programs For Beginners and review their published scope and access details.
• Filter public programs by a published minimum while researching Bug Bounty Reward data.
• Start How To Become A Bug Bounty Hunter research with public program records and their published rules.

📋 Program records with source and scope details

The Actor returns a run output with links to the default dataset and a short run summary. Each saved dataset row is one public bug-bounty or vulnerability-disclosure program. Source values that are not published are left out instead of invented.

Run output

Field	Type	What it does
datasetUrl	URL string	Links to the saved public program records in the default dataset.
runSummary	string	Gives counts of saved programs and the public sources used in the run.

▶️ Search one target at a time

Choose one Target per run: Keyword search, Company or domain, or Program handles or URLs. Fields in the other Target sections are ignored, and shared filters apply to every Target. Choose supported public sources such as HackerOne, Bugcrowd, Intigriti, YesWeHack, or security.txt and security policies. If Sources is empty, all supported sources are searched.

How to run

1. Choose the Target that matches your search.
2. Fill the matching keyword, company or domain, or program handle and URL fields.
3. Choose Sources and add any filters you need.
4. Run the Actor and open the dataset or run summary.

The Actor works with public program information. It does not access private, invite-only, or login-gated programs, scan targets, exploit systems, or submit vulnerability reports.

⚙️ Input

Target is required. Fill the fields for the selected Target; values in other Target sections are ignored. Sources and the other filters apply to every Target.

Input fields

Field	Type	What it does
target	string	Chooses keyword, companyOrDomain, or programs search.
keyword	string	One keyword for finding public bug-bounty or vulnerability-disclosure programs. Used with target: "keyword".
companyOrDomain	string	One company name or domain for related public programs. Used with target: "companyOrDomain".
programs	array of strings	One or more public program handles or URLs, one per line. Used with target: "programs".
sources	array of strings	Public sources to search: hackerone, bugcrowd, intigriti, yeswehack, or securityTxt. Leave it empty to search all supported sources.
maxItems	integer	Stops after this many program records. Leave it empty to return all available results until the selected sources are exhausted.
programType	string	Keeps programs with this public program type. You may enter a different label used by a source.
minimumReward	object	Keeps programs with a published reward at or above the amount and currency below. Programs without a published reward are left out.
minimumReward.amount	number	Minimum published reward amount.
minimumReward.currency	string	Three-letter ISO 4217 currency code, such as USD.
openOnly	boolean	Keeps only programs that accept vulnerability submissions.
safeHarborOnly	boolean	Keeps only programs with detected safe-harbor language.
changedSince	date string	Keeps programs first seen or changed on or after this date. Use YYYY-MM-DD.
scopeTarget	string	Keeps programs whose published scope contains this target or domain. This filter applies to every Target.

Successful input example

This is the smallest common input from a successful current-beta run:

{
  "target": "programs",
  "programs": [
    "github"
  ],
  "sources": [
    "hackerone"
  ],
  "maxItems": 1,
  "openOnly": false,
  "safeHarborOnly": false
}

🧾 Output

Output fields

Field	Type	What it does
datasetUrl	string	Links to the saved program records in the default dataset.
runSummary	string	Summarizes saved-program counts and source coverage for the run.

Dataset row shape

Optional fields appear when a source publishes those values; the Actor does not fill missing source data with guesses.

Field	Type	What it does
name	string	Name of the public security program.
handle	string	Handle used by the source to identify the program.
source	string	Source that provided the row: hackerone, bugcrowd, intigriti, yeswehack, or securityTxt.
programUrl	URL string	Public page for the program.
discoveredBy	string	The one keyword, company, domain, handle, or URL that led to the first saved row.
programType	string	Public program type given by the source, when available.
description	string	Description of the program from the public source, when available.
industries	array of strings	Industries named by the public source.
access	object	Public access and login details reported by the source.
access.isPublic	boolean	Whether the source marks the program as public.
access.requiresLogin	boolean	Whether the source says that a login is needed.
submissionsOpen	boolean	Whether the source says that vulnerability submissions are open.
rewards	array of objects	Published reward amounts or ranges for the program.
rewards[].severity	string	Reward tier or severity label from the source.
rewards[].amount	number	Fixed reward amount published by the source.
rewards[].minimum	number	Lowest amount in a published reward range.
rewards[].maximum	number	Highest amount in a published reward range.
rewards[].currency	string	Three-letter ISO 4217 currency code for the reward.
policyUrls	array of URL strings	Public links to the program policy.
submissionUrls	array of URL strings	Public links for sending vulnerability reports.
securityContact	object	Public security contact details from the source.
securityContact.emails	array of strings	Public email addresses for the security contact.
securityContact.urls	array of URL strings	Public links for contacting the security team.
securityContact.instructions	string	Public instructions for contacting the security team.
scope	object	Published assets that are in or out of scope.
scope.inScope	array of objects	Assets that the source lists as in scope.
scope.inScope[].asset	string	Published in-scope asset name, URL, domain, or pattern.
scope.inScope[].assetType	string	In-scope asset type given by the source.
scope.inScope[].description	string	Source instructions or context for an in-scope asset.
scope.outOfScope	array of objects	Assets that the source lists as out of scope.
scope.outOfScope[].asset	string	Published out-of-scope asset name, URL, domain, or pattern.
scope.outOfScope[].assetType	string	Out-of-scope asset type given by the source.
scope.outOfScope[].description	string	Source instructions or context for an out-of-scope asset.
activity	object	Public activity metrics for the program.
activity.resolvedReports	integer	Number of resolved reports published by the source.
responseTime	object	Published response-time metrics for the program.
responseTime.firstResponseHours	number	Published time to first response, in hours.
responseTime.resolutionHours	number	Published time to resolution, in hours.
priority	object	Published priority or scope-rank details.
priority.rank	integer	Published priority or scope rank.
priority.score	number	Published priority score.
priority.label	string	Published priority label.
history	object	When the program was first and most recently seen.
history.firstSeenAt	date-time string	Time when the program was first seen.
history.lastSeenAt	date-time string	Time when the program was most recently seen.
scopeDiff	object	Published scope items added or removed since the last observation.
scopeDiff.added	array of objects	Assets added to the published scope.
scopeDiff.added[].asset	string	Added asset name, URL, domain, or pattern.
scopeDiff.added[].assetType	string	Type of an added asset.
scopeDiff.added[].description	string	Source context for an added asset.
scopeDiff.removed	array of objects	Assets removed from the published scope.
scopeDiff.removed[].asset	string	Removed asset name, URL, domain, or pattern.
scopeDiff.removed[].assetType	string	Type of a removed asset.
scopeDiff.removed[].description	string	Source context for a removed asset.
scopeChanged	boolean	Whether the published scope changed since the last observation.
retrievedAt	date-time string	Time when this public record was retrieved.

Successful dataset row example

This row is shortened to keep the example small. Each "..." value marks more real scope data that is not shown.

{
  "name": "GitHub",
  "handle": "github",
  "source": "hackerone",
  "programUrl": "https://hackerone.com/github",
  "discoveredBy": "https://hackerone.com/github",
  "programType": "bug-bounty",
  "access": {
    "isPublic": true
  },
  "scope": {
    "inScope": [
      {
        "asset": "*.github.net",
        "assetType": "URL",
        "description": "Subdomains under `*.github.net` run services for our internal production network. Many of these services are not accessible from outside our internal network. Not all subdomains are [in-scope](https://bounty.github.com/#scope)"
      },
      "..."
    ],
    "outOfScope": [
      {
        "asset": "*.github.io",
        "assetType": "URL",
        "description": "Individual sites which are hosted on GitHub Pages are out-of-scope."
      },
      "..."
    ]
  },
  "responseTime": {
    "firstResponseHours": 92,
    "resolutionHours": 1651
  },
  "history": {
    "firstSeenAt": "2026-08-04T18:36:43.455Z",
    "lastSeenAt": "2026-08-04T20:56:38.409Z"
  },
  "scopeChanged": false,
  "retrievedAt": "2026-08-04T20:56:38.409Z"
}

💳 Pricing

Pay-per-event pricing

The Actor uses pay-per-event pricing. The public-disclosure-program-record event is titled Program and costs $0.00001 for each public program saved to the dataset. The event covers a saved program; this copy makes no separate charge claim for empty, setup, diagnostic, or no-result work.

🔌 Integrations

Use the dataset URL or Apify API after a run, then export the rows or send them to an Apify integration. You can also send the saved program rows to a spreadsheet, database, or your own app.

❓ FAQ

Can I look up one exact public program?

Yes. Choose Program handles or URLs and enter one or more public handles or URLs, such as github or https://hackerone.com/github.

Can I search by company or domain?

Yes. Choose Company or domain and enter one company name or domain. You can also use Scope contains to keep programs whose published scope contains a target or domain.

Which public sources can I search?

You can choose HackerOne, Bugcrowd, Intigriti, YesWeHack, or security.txt and security policies. Source values can be missing when a source does not publish them.

Does the Actor rank the best bug bounty platforms?

No. It finds public program records and returns source, links, rewards, scope, access, status, and other published details. You can review those fields to make your own choice.

Can I filter for rewards or open programs?

Yes. Use Minimum reward to set a published amount and currency, or turn on Open programs only. You can also filter by program type, safe-harbor language, changed date, or published scope.

What happens when the same program matches twice?

The Actor saves the first eligible match and ignores later matches for that program. The discoveredBy value describes the first saved match, not every later search value.

Does it find private programs or submit vulnerability reports?

No. It uses public program information only. It does not access private or login-gated programs, scan systems, exploit targets, or submit reports.

What happens if I leave Maximum results empty?

The Actor returns all available results until the selected sources are exhausted. Add a value when you want the run to stop after a set number of program records.

📝 Changelog

0.0: Initial release

🆘 Support

For issues, questions, or feature requests, file a ticket and I'll fix or implement it in less than 24h 🫡

🔗 Related Actors

• GitHub Security Advisories Scraper — Review public GitHub advisories after you find related security programs.
• Bug Bounty Program Scope Tracker Scraper — Compare public program scope and scope changes across major platforms.
• Bug Bounty Program Finder — Add security.txt contacts, rewards, safe-harbor notes, and policy URLs to program research.
• Bugcrowd Bug Bounty Programs Scraper — Focus on Bugcrowd program names, rewards, industries, access status, and scope rank.
• HackerOne Programs Scraper — Collect HackerOne bounty ranges, submission status, response metrics, and policy URLs.

Made with ❤️ by Maxime Dupré