Bugcrowd Scraper

Bugcrowd Scraper extracts publicly visible data from Bugcrowd, the crowdsourced security/bug bounty platform, in three modes: the public Crowdstream ("hacktivity" equivalent — accepted/disclosed submission activity), the public bug bounty program directory, and the researcher points leaderboard. It calls Bugcrowd's own JSON endpoints directly (the same ones bugcrowd.com's own pages use), so it's fast and doesn't render pages in a browser. Run it on the Apify platform to get scheduling, API access, webhooks, and dataset export for free.

Why use Bugcrowd Scraper?

• Bug bounty market research — see which companies run public programs, their reward ranges, industries, and access status (open vs. invite-only).
• Vulnerability activity tracking — monitor the public Crowdstream feed for accepted/disclosed submission activity across programs, by priority (P1-P5) and target.
• Researcher/community insight — pull the top-ranked researchers by points and valid submission count, all-time or past-month.
• Competitive/vendor due diligence — check whether a vendor runs a Bugcrowd program and what its reward structure looks like before engaging.

How to use Bugcrowd Scraper

1. Click Try for free (or Run) on this Actor's page.
2. Pick a Mode: hacktivity (Crowdstream activity), programs (program directory), or leaderboard (researcher rankings).
3. Set Max items (0 = unlimited for hacktivity/programs; leaderboard is always capped at 100 by Bugcrowd itself).
4. For hacktivity/programs, optionally set a Start page to resume/skip ahead.
5. For programs, optionally set a Search query (e.g. "okta" or "bank") to narrow the directory to matching programs, using the same search Bugcrowd's own program directory page offers. Not available for hacktivity/leaderboard — Bugcrowd's public pages have no keyword search for those.
6. Optionally turn on Include full report (hacktivity), or Include target scope / Include bounty tiers (programs) for deeper per-row detail — each costs 1-2 extra HTTP requests (and a small extra charge) per row. See Known limitations below for the one piece of data that's genuinely not public (individual comment text).
7. For leaderboard, pick a Leaderboard period (all-time or past-month).
8. Click Start and watch results land in the dataset in real time.

Input

Field	Type	Description
mode	string	hacktivity, programs, or leaderboard. Required.
maxItems	integer	Max rows to scrape (0 = unlimited for hacktivity/programs). Default 100.
startPage	integer	1-indexed page to start from. Only used for hacktivity/programs. Default 1.
hacktivityIncludeFullReport	boolean	hacktivity only. Fetch each disclosed submission's full write-up + public activity timeline (1 extra request per disclosed row). Default false. See caveats below.
programsIncludeScope	boolean	programs only. Fetch each program's target-group/scope list (1-2 extra requests per program, shared with programsIncludeBountyTable). Default false.
programsIncludeBountyTable	boolean	programs only. Fetch each program's full P1-P5 reward table per target group (1-2 extra requests per program, shared with programsIncludeScope). Default false.
programsSearchQuery	string	programs only. Keyword/text search over the program directory -- the real search param used by bugcrowd.com/engagements' own search box (verified live: e.g. "okta" narrows the ~250-program directory to 5 results). Full-text, not just a name match. Blank = full unfiltered directory. Not available for hacktivity/leaderboard -- Bugcrowd's public pages have no text search for those.
leaderboardPeriod	string	all-time or past-month. Only used for leaderboard. Default all-time.
proxyConfiguration	object	Optional proxy config. Not required — see Tips below.

See the Input tab for the full schema with defaults.

Output

Each dataset item is one row from the selected mode. Examples:

hacktivity:

{
  "mode": "hacktivity",
  "id": "13bd6066-7fdb-46c1-a464-7ac1af833486",
  "engagementName": "ClickHouse",
  "engagementUrl": "https://bugcrowd.com/engagements/clickhouse",
  "researcherUsername": "0x88",
  "researcherProfileUrl": "https://bugcrowd.com/h/0x88",
  "points": 5,
  "priority": 4,
  "target": "https://cloud.langfuse.com/",
  "submissionStateText": "Submission accepted on target: https://cloud.langfuse.com/",
  "acceptedAt": "16 Aug 2026",
  "disclosed": true,
  "disclosureReportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump",
  "fullReport": {
    "title": "XML External Entity Injection in NASA CMR Ingest API - info dump",
    "summaryAuthor": "thomasito",
    "summaryText": "An XXE vulnerability was identified in NASA's Common Metadata Repository that enabled unauthenticated arbitrary file reads and server-side request forgery (SSRF). ...",
    "summaryHtml": "<p>An XXE vulnerability was identified...</p>",
    "activityTimeline": [
      { "key": "submission.created", "verb": "created the submission", "actorName": "thomasito", "createdAt": "2025-10-26T00:04:45Z", "substate": null, "isComment": false },
      { "key": "comment.created", "verb": "sent a", "actorName": "brunoc_bugcrowd", "createdAt": "2025-10-27T11:23:02Z", "substate": null, "isComment": true }
    ],
    "reportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump"
  }
}

fullReport is only populated when hacktivityIncludeFullReport: true and the row is publicly disclosed; otherwise it's null. Note activityTimeline entries carry event metadata (who, when, what kind of event) but not the actual text of each comment — Bugcrowd doesn't render individual comment bodies on the public disclosure page (see "Known limitations" below).

programs (with programsIncludeScope: true, programsIncludeBountyTable: true):

{
  "mode": "programs",
  "name": "Nubank Brasil Managed Bug Bounty Program",
  "programUrl": "https://bugcrowd.com/engagements/nubank",
  "rewardSummary": "$50 - $4,000",
  "minReward": "$50",
  "maxReward": "$4,000",
  "industryName": "Finance",
  "accessStatus": "open",
  "engagementTypeLabel": "Bug Bounty",
  "scopeRank": 4,
  "targetGroups": [
    {
      "groupName": "Core Assets",
      "inScope": true,
      "targets": [
        { "name": "Nubank Android: Play Store", "uri": "https://play.google.com/store/apps/details?id=com.nu.production", "category": "android", "tags": ["Android"] },
        { "name": "prod-*.nubank.com.br", "uri": null, "category": "api", "tags": [] }
      ]
    },
    { "groupName": "Out of Scope", "inScope": false, "targets": [ { "name": "*.nuinternational.com", "uri": null, "category": null, "tags": [] } ] }
  ],
  "bountyTiers": [
    { "groupName": "Core Assets", "inScope": true, "p1": { "min": 2000, "max": 4000 }, "p2": { "min": 1000, "max": 2000 }, "p3": { "min": 300, "max": 600 }, "p4": { "min": 50, "max": 100 } },
    { "groupName": "Primary Assets", "inScope": true, "p1": { "min": 1000, "max": 2000 }, "p2": { "min": 600, "max": 1000 }, "p3": { "min": 300, "max": 400 }, "p4": { "min": 50, "max": 100 } }
  ]
}

targetGroups and bountyTiers are only fetched when programsIncludeScope / programsIncludeBountyTable are true — both null by default. They're derived from the same public, unauthenticated source: the program's engagement-brief "Targets" tab data (see "Known limitations" for how this was found and verified). targetGroups is [{groupName, inScope, targets: [{name, uri, category, tags}]}]; bountyTiers is [{groupName, inScope, p1..p5: {min, max}}] (whole-currency units, USD for USD-priced programs) — reward ranges can differ per target group within the same program.

leaderboard:

{
  "mode": "leaderboard",
  "period": "all-time",
  "rank": 1,
  "username": "todayisnew",
  "points": 50052,
  "validSubmissions": 4519,
  "profileUrl": "https://bugcrowd.com/h/todayisnew",
  "countryCode": "CA"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from the Storage → Dataset tab or via the API.

Data table

Field	Modes	Description
mode	all	Which mode produced this row.
engagementName, engagementUrl, target, priority, points, submissionStateText	hacktivity	Crowdstream activity row: program, target, severity priority, points awarded, human-readable state.
researcherUsername, researcherProfileUrl	hacktivity	The researcher credited, if their name is public on that row (some rows are anonymized by the researcher's own privacy settings).
disclosed, disclosureReportUrl	hacktivity	Whether the submission was publicly disclosed, and (if so) the link to its full public disclosure report page.
fullReport	hacktivity	Only when hacktivityIncludeFullReport: true and disclosed: true: {title, summaryAuthor, summaryText, summaryHtml, activityTimeline, reportUrl} — the full researcher write-up plus a public activity/event timeline (not full comment text; see Known limitations). null otherwise.
name, programUrl, rewardSummary, minReward, maxReward, industryName, accessStatus, scopeRank	programs	Program directory listing: name, reward range, industry, whether it's open or invite-only, and a 1-5 scope difficulty rank.
targetGroups	programs	Only when programsIncludeScope: true: the program's target-group/asset scope list, [{groupName, inScope, targets: [{name, uri, category, tags}]}], from the program's public engagement-brief page. null when the flag is off or the fetch failed.
bountyTiers	programs	Only when programsIncludeBountyTable: true: the program's P1-P5 reward table per target group, [{groupName, inScope, p1..p5: {min, max}}]. null when the flag is off or the fetch failed.
rank, username, points, validSubmissions, profileUrl, countryCode	leaderboard	Researcher's leaderboard rank, points, valid submission count, and public profile link. This is the full set of fields Bugcrowd's public leaderboard endpoint exposes — see Known limitations for why there's no deeper per-researcher "track record" (badges, per-program breakdown, first-to-find count).

Pricing

This Actor uses Pay-Per-Event pricing. You're charged per row returned, priced by how data-rich that row type is:

Event	Price	Charged when
Hacktivity (Crowdstream) entry	$0.0015	Per hacktivity row pushed
Hacktivity full report	$0.003	Per disclosed hacktivity row where fullReport was successfully fetched (hacktivityIncludeFullReport: true)
Program listing	$0.001	Per programs row pushed
Program scope/bounty detail	$0.0025	Per programs row where targetGroups and/or bountyTiers was successfully fetched from the public engagement brief (programsIncludeScope / programsIncludeBountyTable)
Leaderboard entry	$0.0008	Per leaderboard row pushed

A typical exploratory run (a few hundred rows) costs well under $1. Set maxItems to control spend directly.

Tips

• leaderboard mode is always capped at 100 rows (that's Bugcrowd's own limit on this endpoint) — maxItems above 100 has no additional effect there.
• Use startPage to resume a large hacktivity/programs crawl without re-scraping earlier pages.
• All endpoints used by this Actor responded without a proxy or special headers during development. Only enable Proxy configuration (residential recommended) if you start seeing blocking or Cloudflare challenges — it's off by default to keep runs cheap and fast.

Known limitations

• Program scope/target lists and P1-P5 reward tables ARE public — no login needed. An earlier version of this Actor claimed this data required a Bugcrowd researcher login, based on testing only the /engagements/<handle>/target_groups.json and /rewards.json routes (which do redirect to the login-gated Hacker Portal). That conclusion was wrong: the real bugcrowd.com engagement brief page (e.g. bugcrowd.com/engagements/nubank) renders a full "Targets" tab — target-group names, in/out-of-scope status, per-asset name/URI/category/tags, and a P1-P5 reward table per target group — without any login, verified with a real headless-browser session on a logged-out page. That page fetches the data from

  GET /engagements/<handle>/ changelog.json
  (list of published brief revisions) then

  GET /engagements/<handle>/ changelog/<id>.json
  (full detail for the "Latest" revision), both confirmed public with a bare curl (no cookies, no proxy) across open bug-bounty programs (nubank, okta) and VDPs (nasa-vdp) alike. programsIncludeScope / programsIncludeBountyTable now use this real mechanism and return real data. The scope-adjacent scopeRank (1-5 difficulty score) remains included on every programs row regardless of these flags, as before.
• Full comment text on disclosed submissions is not public. hacktivityIncludeFullReport successfully fetches the full researcher write-up (the actual vulnerability description/PoC) from each disclosed submission's public disclosure page — that part works reliably. Its activityTimeline, however, only carries comment/state-change metadata (who, when, what kind of event) because Bugcrowd's public disclosure page doesn't render individual comment bodies server-side; that content is fetched by the same login-gated Hacker Portal SPA as above.
• Keyword search exists for programs, not for hacktivity/leaderboard. The public program directory page has a real search box; it fires

  GET /engagement_listings.json?search=<term>&...
  , and the same search param also works on the engagements.json endpoint this Actor already uses for programs (confirmed live: search=okta narrows Bugcrowd's ~250-program directory to 5 hits, search=bank to ~40, a nonsense term to 0) — wired up as programsSearchQuery. The public Crowdstream and Leaderboard pages, by contrast, have no text search box and no search-style query parameter on crowdstream.json / leaderboard/data — only toggles/dropdowns (accepted/disclosed, priority, country, period), all already covered by existing inputs. No fabricated search param was added for those two modes.
• No public per-researcher "track record" beyond the leaderboard. Each researcher's /h/<username> profile page is a client-rendered SPA shell with no embedded data and no discovered public JSON API (confirmed again during this round of development — the page is identical in size/shape whether logged in or not, and ships no server-rendered stats). leaderboard mode already surfaces every field Bugcrowd's public leaderboard endpoint exposes (rank, username, points, valid submissions, country, profile URL) — there are no additional unused fields on that endpoint to add. Deeper track-record data (badges, first-to-find count, per-program point breakdown, response history) simply isn't available without a login, so no researchers mode or extra leaderboard flag was added rather than fabricate one.

Cyber recon toolkit

Part of the Cyber recon toolkit — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

• HackerOne Scraper — Scrapes public HackerOne data: Hacktivity disclosed reports, program directory, researcher leaderboard.
• Intigriti Scraper — Scrapes public Intigriti data: bug bounty/VDP program directory, researcher leaderboard and profiles.
• CVE Scraper — CVE.org vulnerability info scraper.
• TLSX - TLS Data Gathering and Analysis — Fast, configurable TLS grabber for TLS-based data collection and analysis.
• BGP.HE.NET Recon Scraper — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
• gau - Get All URLs — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
• Git Email Extractor — Shallow-clones git repos and extracts contributor emails from commit history.
• Wappalyzer Technology Lookup — Detect the technology stack behind any website using Wappalyzer.
• Meta Tags Scraper — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
• Universal Contact Extractor — Extract phone numbers, emails and social media URLs from web pages.
• Web Text Extractor — Extract clean text or Markdown content from web pages.

Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

FAQ & disclaimers

This Actor only accesses publicly visible Bugcrowd data — the same Crowdstream, program directory, and leaderboard pages anyone can view at bugcrowd.com without logging in. It does not use, require, or store login credentials, and it cannot access private program details, non-public submissions, or authenticated researcher data. There is no crawlable public directory of individual researcher profiles beyond the leaderboard: each researcher's /h/<username> profile page is a client-rendered single-page app with no discovered public JSON API, so a separate "researchers" mode was not implemented — the leaderboard mode already surfaces the public researcher directory data (rank, username, points, valid submissions, country, profile link) that Bugcrowd exposes.

Use this Actor in accordance with Bugcrowd's Terms of Service. Website structures and APIs can change — if the Actor stops returning data, please open an issue on the Actor's Issues tab. Need a custom variant (different fields, sites, or pipelines)? Reach out via Apify's custom development services.