# Bug Bounty Programs Scraper (`maximedupre/bug-bounty-programs`) Actor

Find public bug-bounty and vulnerability-disclosure programs from selected sources. Search by keyword, company or domain, or program handle, then save normalized records with public links and available rewards, scope, and status.

- **URL**: https://apify.com/maximedupre/bug-bounty-programs.md
- **Developed by:** [Maxime Dupré](https://apify.com/maximedupre) (community)
- **Categories:** Developer tools, Business, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$0.01 / 1,000 programs

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### 🛡️ Find Public Bug Bounty Programs

Security researchers, AppSec teams, and people learning bug hunting can use this Actor to find public bug-bounty and vulnerability-disclosure programs. It saves one normalized row for each first eligible program match, with the source, public links, rewards, scope, access details, status, and run history. Use the rows to choose public targets and review their published rules.

When the same program appears again from another search value, the Actor keeps the first saved match and ignores the later one. `discoveredBy` shows the one value that led to that first row.

- Search selected public sources for [**Bug Bounty Platforms**](https://apify.com/maximedupre/bug-bounty-programs/examples/bug-bounty-platforms) records and compare their source, program type, and public links.
- Find public targets for a [**Bug Bounty Hunter**](https://apify.com/maximedupre/bug-bounty-programs/examples/bug-bounty-hunter) by searching a keyword, company, domain, handle, or URL.
- Find public programs connected to [**Bug Bounty Programs For Beginners**](https://apify.com/maximedupre/bug-bounty-programs/examples/bug-bounty-programs-for-beginners) and review their published scope and access details.
- Filter public programs by a published minimum while researching [**Bug Bounty Reward**](https://apify.com/maximedupre/bug-bounty-programs/examples/bug-bounty-reward) data.
- Start [**How To Become A Bug Bounty Hunter**](https://apify.com/maximedupre/bug-bounty-programs/examples/how-to-become-a-bug-bounty-hunter) research with public program records and their published rules.

#### 📋 Program records with source and scope details

The Actor returns a run output with links to the default dataset and a short run summary. Each saved dataset row is one public bug-bounty or vulnerability-disclosure program. Source values that are not published are left out instead of invented.

**Run output**

| Field | Type | What it does |
| --- | --- | --- |
| `datasetUrl` | URL string | Links to the saved public program records in the default dataset. |
| `runSummary` | string | Gives counts of saved programs and the public sources used in the run. |

#### ▶️ Search one target at a time

Choose one Target per run: Keyword search, Company or domain, or Program handles or URLs. Fields in the other Target sections are ignored, and shared filters apply to every Target. Choose supported public sources such as HackerOne, Bugcrowd, Intigriti, YesWeHack, or security.txt and security policies. If Sources is empty, all supported sources are searched.

**How to run**

1. Choose the Target that matches your search.
2. Fill the matching keyword, company or domain, or program handle and URL fields.
3. Choose Sources and add any filters you need.
4. Run the Actor and open the dataset or run summary.

The Actor works with public program information. It does not access private, invite-only, or login-gated programs, scan targets, exploit systems, or submit vulnerability reports.

#### ⚙️ Input

Target is required. Fill the fields for the selected Target; values in other Target sections are ignored. Sources and the other filters apply to every Target.

**Input fields**

| Field | Type | What it does |
| --- | --- | --- |
| `target` | string | Chooses `keyword`, `companyOrDomain`, or `programs` search. |
| `keyword` | string | One keyword for finding public bug-bounty or vulnerability-disclosure programs. Used with `target: "keyword"`. |
| `companyOrDomain` | string | One company name or domain for related public programs. Used with `target: "companyOrDomain"`. |
| `programs` | array of strings | One or more public program handles or URLs, one per line. Used with `target: "programs"`. |
| `sources` | array of strings | Public sources to search: `hackerone`, `bugcrowd`, `intigriti`, `yeswehack`, or `securityTxt`. Leave it empty to search all supported sources. |
| `maxItems` | integer | Stops after this many program records. Leave it empty to return all available results until the selected sources are exhausted. |
| `programType` | string | Keeps programs with this public program type. You may enter a different label used by a source. |
| `minimumReward` | object | Keeps programs with a published reward at or above the amount and currency below. Programs without a published reward are left out. |
| `minimumReward.amount` | number | Minimum published reward amount. |
| `minimumReward.currency` | string | Three-letter ISO 4217 currency code, such as `USD`. |
| `openOnly` | boolean | Keeps only programs that accept vulnerability submissions. |
| `safeHarborOnly` | boolean | Keeps only programs with detected safe-harbor language. |
| `changedSince` | date string | Keeps programs first seen or changed on or after this date. Use `YYYY-MM-DD`. |
| `scopeTarget` | string | Keeps programs whose published scope contains this target or domain. This filter applies to every Target. |

**Successful input example**

This is the smallest common input from a successful current-beta run:

```json
{
  "target": "programs",
  "programs": [
    "github"
  ],
  "sources": [
    "hackerone"
  ],
  "maxItems": 1,
  "openOnly": false,
  "safeHarborOnly": false
}
```

#### 🧾 Output

**Output fields**

| Field | Type | What it does |
| --- | --- | --- |
| `datasetUrl` | string | Links to the saved program records in the default dataset. |
| `runSummary` | string | Summarizes saved-program counts and source coverage for the run. |

**Dataset row shape**

Optional fields appear when a source publishes those values; the Actor does not fill missing source data with guesses.

| Field | Type | What it does |
| --- | --- | --- |
| `name` | string | Name of the public security program. |
| `handle` | string | Handle used by the source to identify the program. |
| `source` | string | Source that provided the row: `hackerone`, `bugcrowd`, `intigriti`, `yeswehack`, or `securityTxt`. |
| `programUrl` | URL string | Public page for the program. |
| `discoveredBy` | string | The one keyword, company, domain, handle, or URL that led to the first saved row. |
| `programType` | string | Public program type given by the source, when available. |
| `description` | string | Description of the program from the public source, when available. |
| `industries` | array of strings | Industries named by the public source. |
| `access` | object | Public access and login details reported by the source. |
| `access.isPublic` | boolean | Whether the source marks the program as public. |
| `access.requiresLogin` | boolean | Whether the source says that a login is needed. |
| `submissionsOpen` | boolean | Whether the source says that vulnerability submissions are open. |
| `rewards` | array of objects | Published reward amounts or ranges for the program. |
| `rewards[].severity` | string | Reward tier or severity label from the source. |
| `rewards[].amount` | number | Fixed reward amount published by the source. |
| `rewards[].minimum` | number | Lowest amount in a published reward range. |
| `rewards[].maximum` | number | Highest amount in a published reward range. |
| `rewards[].currency` | string | Three-letter ISO 4217 currency code for the reward. |
| `policyUrls` | array of URL strings | Public links to the program policy. |
| `submissionUrls` | array of URL strings | Public links for sending vulnerability reports. |
| `securityContact` | object | Public security contact details from the source. |
| `securityContact.emails` | array of strings | Public email addresses for the security contact. |
| `securityContact.urls` | array of URL strings | Public links for contacting the security team. |
| `securityContact.instructions` | string | Public instructions for contacting the security team. |
| `scope` | object | Published assets that are in or out of scope. |
| `scope.inScope` | array of objects | Assets that the source lists as in scope. |
| `scope.inScope[].asset` | string | Published in-scope asset name, URL, domain, or pattern. |
| `scope.inScope[].assetType` | string | In-scope asset type given by the source. |
| `scope.inScope[].description` | string | Source instructions or context for an in-scope asset. |
| `scope.outOfScope` | array of objects | Assets that the source lists as out of scope. |
| `scope.outOfScope[].asset` | string | Published out-of-scope asset name, URL, domain, or pattern. |
| `scope.outOfScope[].assetType` | string | Out-of-scope asset type given by the source. |
| `scope.outOfScope[].description` | string | Source instructions or context for an out-of-scope asset. |
| `activity` | object | Public activity metrics for the program. |
| `activity.resolvedReports` | integer | Number of resolved reports published by the source. |
| `responseTime` | object | Published response-time metrics for the program. |
| `responseTime.firstResponseHours` | number | Published time to first response, in hours. |
| `responseTime.resolutionHours` | number | Published time to resolution, in hours. |
| `priority` | object | Published priority or scope-rank details. |
| `priority.rank` | integer | Published priority or scope rank. |
| `priority.score` | number | Published priority score. |
| `priority.label` | string | Published priority label. |
| `history` | object | When the program was first and most recently seen. |
| `history.firstSeenAt` | date-time string | Time when the program was first seen. |
| `history.lastSeenAt` | date-time string | Time when the program was most recently seen. |
| `scopeDiff` | object | Published scope items added or removed since the last observation. |
| `scopeDiff.added` | array of objects | Assets added to the published scope. |
| `scopeDiff.added[].asset` | string | Added asset name, URL, domain, or pattern. |
| `scopeDiff.added[].assetType` | string | Type of an added asset. |
| `scopeDiff.added[].description` | string | Source context for an added asset. |
| `scopeDiff.removed` | array of objects | Assets removed from the published scope. |
| `scopeDiff.removed[].asset` | string | Removed asset name, URL, domain, or pattern. |
| `scopeDiff.removed[].assetType` | string | Type of a removed asset. |
| `scopeDiff.removed[].description` | string | Source context for a removed asset. |
| `scopeChanged` | boolean | Whether the published scope changed since the last observation. |
| `retrievedAt` | date-time string | Time when this public record was retrieved. |

**Successful dataset row example**

This row is shortened to keep the example small. Each `"..."` value marks more real scope data that is not shown.

```json
{
  "name": "GitHub",
  "handle": "github",
  "source": "hackerone",
  "programUrl": "https://hackerone.com/github",
  "discoveredBy": "https://hackerone.com/github",
  "programType": "bug-bounty",
  "access": {
    "isPublic": true
  },
  "scope": {
    "inScope": [
      {
        "asset": "*.github.net",
        "assetType": "URL",
        "description": "Subdomains under `*.github.net` run services for our internal production network. Many of these services are not accessible from outside our internal network. Not all subdomains are [in-scope](https://bounty.github.com/#scope)"
      },
      "..."
    ],
    "outOfScope": [
      {
        "asset": "*.github.io",
        "assetType": "URL",
        "description": "Individual sites which are hosted on GitHub Pages are out-of-scope."
      },
      "..."
    ]
  },
  "responseTime": {
    "firstResponseHours": 92,
    "resolutionHours": 1651
  },
  "history": {
    "firstSeenAt": "2026-08-04T18:36:43.455Z",
    "lastSeenAt": "2026-08-04T20:56:38.409Z"
  },
  "scopeChanged": false,
  "retrievedAt": "2026-08-04T20:56:38.409Z"
}
```

#### 💳 Pricing

**Pay-per-event pricing**

The Actor uses pay-per-event pricing. The `public-disclosure-program-record` event is titled **Program** and costs $0.00001 for each public program saved to the dataset. The event covers a saved program; this copy makes no separate charge claim for empty, setup, diagnostic, or no-result work.

#### 🔌 Integrations

https://www.youtube.com/watch?v=bNACk1\_S\_6w\&list=PLObrtcm1Kw6MUrlLNDbK9QRg8VDJg0gOW\&index=4

Use the dataset URL or Apify API after a run, then export the rows or send them to an Apify integration. You can also send the saved program rows to a spreadsheet, database, or your own app.

#### ❓ FAQ

##### Can I look up one exact public program?

Yes. Choose Program handles or URLs and enter one or more public handles or URLs, such as `github` or `https://hackerone.com/github`.

##### Can I search by company or domain?

Yes. Choose Company or domain and enter one company name or domain. You can also use Scope contains to keep programs whose published scope contains a target or domain.

##### Which public sources can I search?

You can choose HackerOne, Bugcrowd, Intigriti, YesWeHack, or security.txt and security policies. Source values can be missing when a source does not publish them.

##### Does the Actor rank the best bug bounty platforms?

No. It finds public program records and returns source, links, rewards, scope, access, status, and other published details. You can review those fields to make your own choice.

##### Can I filter for rewards or open programs?

Yes. Use Minimum reward to set a published amount and currency, or turn on Open programs only. You can also filter by program type, safe-harbor language, changed date, or published scope.

##### What happens when the same program matches twice?

The Actor saves the first eligible match and ignores later matches for that program. The `discoveredBy` value describes the first saved match, not every later search value.

##### Does it find private programs or submit vulnerability reports?

No. It uses public program information only. It does not access private or login-gated programs, scan systems, exploit targets, or submit reports.

##### What happens if I leave Maximum results empty?

The Actor returns all available results until the selected sources are exhausted. Add a value when you want the run to stop after a set number of program records.

### 📝 Changelog

**0.0: Initial release**

### 🆘 Support

For issues, questions, or feature requests, [file a ticket](https://console.apify.com/actors/maximedupre~bug-bounty-programs/issues) and I'll fix or implement it in less than 24h 🫡

### 🔗 Related Actors

- [GitHub Security Advisories Scraper](https://apify.com/maximedupre/github-security-advisories-scraper) — Review public GitHub advisories after you find related security programs.
- [Bug Bounty Program Scope Tracker Scraper](https://apify.com/jungle_synthesizer/bug-bounty-program-scope-tracker-scraper) — Compare public program scope and scope changes across major platforms.
- [Bug Bounty Program Finder](https://apify.com/thescrapelab/bug-bounty-program-finder) — Add security.txt contacts, rewards, safe-harbor notes, and policy URLs to program research.
- [Bugcrowd Bug Bounty Programs Scraper](https://apify.com/parseforge/bugcrowd-programs-scraper) — Focus on Bugcrowd program names, rewards, industries, access status, and scope rank.
- [HackerOne Programs Scraper](https://apify.com/automation-lab/hackerone-programs-scraper) — Collect HackerOne bounty ranges, submission status, response metrics, and policy URLs.

**Made with ❤️ by Maxime Dupré**

# Actor input Schema

## `target` (type: `string`):

Choose the kind of public program search to run.

## `keyword` (type: `string`):

Enter one keyword to find public bug-bounty and vulnerability-disclosure programs.

## `companyOrDomain` (type: `string`):

Enter one company name or domain to find related public programs. Example: acme.com.

## `programs` (type: `array`):

Enter one or more public program handles or URLs, one per line. Example: acme or https://hackerone.com/acme.

## `sources` (type: `array`):

Choose the public sources to search. Leave this empty to search all supported sources.

## `maxItems` (type: `integer`):

Stop after this many program records. Leave it empty to return all available results until the selected sources are exhausted.

## `programType` (type: `string`):

Return only programs with this public program type. You may enter a different type if a source uses another label.

## `minimumReward` (type: `object`):

Return only programs with a published reward at or above this amount. Programs without a published reward are left out.

## `openOnly` (type: `boolean`):

Return only programs that accept vulnerability submissions.

## `safeHarborOnly` (type: `boolean`):

Return only programs with detected safe-harbor language.

## `changedSince` (type: `string`):

Return programs first seen or changed on or after this date.

## `scopeTarget` (type: `string`):

Return only programs whose published scope contains this target or domain. This filter applies to every Target.

## Actor input object example

```json
{
  "target": "programs",
  "programs": [
    "github"
  ],
  "sources": [
    "hackerone"
  ],
  "maxItems": 1,
  "openOnly": false,
  "safeHarborOnly": false
}
```

# Actor output Schema

## `datasetUrl` (type: `string`):

URL for the public program records saved in the default dataset.

## `runSummary` (type: `string`):

Counts of saved programs and the public sources used in this run.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "target": "programs",
    "programs": [
        "github"
    ],
    "sources": [
        "hackerone"
    ],
    "maxItems": 1
};

// Run the Actor and wait for it to finish
const run = await client.actor("maximedupre/bug-bounty-programs").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "target": "programs",
    "programs": ["github"],
    "sources": ["hackerone"],
    "maxItems": 1,
}

# Run the Actor and wait for it to finish
run = client.actor("maximedupre/bug-bounty-programs").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "target": "programs",
  "programs": [
    "github"
  ],
  "sources": [
    "hackerone"
  ],
  "maxItems": 1
}' |
apify call maximedupre/bug-bounty-programs --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=maximedupre/bug-bounty-programs",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/a8t2ZjaT110alt3tq/builds/6qhgtt3D4pr3fKbV0/openapi.json