HackerOne Scraper

HackerOne Scraper extracts public data from HackerOne, the leading bug bounty and vulnerability disclosure platform, by calling HackerOne's own web-app GraphQL API directly — the same API hackerone.com itself uses, reverse engineered from its frontend JS bundle (see hackerone_api.md at the repo root). It's fast and doesn't render pages in a browser. Four modes are supported: the Hacktivity disclosed-vulnerability-report feed, the public program directory, the public leaderboard of top researchers, and the public pentester/hacker directory. Run it on the Apify platform to get scheduling, API access, webhooks, and dataset export.

Important: this Actor only accesses public HackerOne data — the public Hacktivity feed, the public program directory, the public leaderboard, and the public, opt-in pentester directory. It does not log in, does not require credentials, and cannot access private programs, private/non-disclosed report content, or any authenticated-only data.

Why use HackerOne Scraper?

• Security research — track newly disclosed vulnerability classes, CWEs, and severities across the whole HackerOne ecosystem or a specific program.
• Bug bounty market research — see which programs pay bounties, how much, and how many reports they've resolved, to plan where to focus hunting effort.
• Competitive/vendor risk monitoring — watch a specific vendor's disclosed reports and program health over time.
• Community/talent insight — pull top-researcher leaderboards and public pentester profiles for recruiting or community analysis.

How to use HackerOne Scraper

1. Click Try for free (or Run) on this Actor's page.
2. Pick a Mode: hacktivity, programs, leaderboard, or hackers.
3. Set the mode-specific filters (see Input below) and a Max items cap (0 = unlimited, except leaderboard which HackerOne itself caps at 100 entries).
4. Click Start and watch results land in the dataset in real time.

Input

Field	Type	Description
mode	string	One of hacktivity, programs, leaderboard, hackers.
maxItems	integer	Max items to scrape (0 = unlimited). Default 100.
hacktivitySearchQuery	string	(hacktivity) Raw Hacktivity search syntax, e.g. severity_rating:critical.
hacktivityProgramHandle	string	(hacktivity) Restrict to one program, e.g. curl.
hacktivityDisclosedOnly	boolean	(hacktivity) Only publicly disclosed reports. Default false.
hacktivityPageSize	integer	(hacktivity) Items per page. Default 25.
hacktivityIncludeFullReport	boolean	(hacktivity) For disclosed reports, fetch the full report write-up, human-authored team/researcher summaries, the public participant list, severity/weakness/attachments, and the full activity/discussion timeline including comment/reply text (2 extra calls per disclosed report). Default false.
programsSearchQuery	string	(programs) Free-text search, matching the real search box on hackerone.com/directory/programs — case-insensitive substring match against the program name and its policy text (and the equivalent fields on external_program for VDP-only listings). Combined with programsOffersBounties using AND.
programsOffersBounties	string	(programs) any / true / false. Default any.
programsIncludeScope	boolean	(programs) Fetch each program's structured scope / target assets (1 extra call per program). Default false.
programsIncludeBountyTable	boolean	(programs) Fetch each program's bounty table by severity (1 extra call per program). Default false.
leaderboardKey	string	(leaderboard) Which ranking, e.g. ALL_TIME_REPUTATION, HIGHEST_REPUTATION, CTF_POINTS, ...
leaderboardUserType	string	(leaderboard) Optional user type filter.
leaderboardYear	integer	(leaderboard) Required for every key except ALL_TIME_REPUTATION.
leaderboardQuarter	integer	(leaderboard) Optional quarter (1-4).
hackersPageSize	integer	(hackers) Items per page. Default 25.
hackersIncludeTrackRecord	boolean	(hackers) Fetch each hacker's public track record: rank, reputation, signal/impact percentiles, resolved report count, badges, reviews (1 extra call per hacker). Default false.
proxyConfiguration	object	Proxy config. No proxy is used by default — HackerOne's public GraphQL API was not observed to block plain datacenter requests.

See the Input tab for the full schema with defaults.

Output

Each dataset item is one row, tagged with itemType. Example (hacktivity, disclosed):

{
  "itemType": "hacktivity-report",
  "id": "3799010",
  "reportUrl": "https://hackerone.com/reports/3799010",
  "title": "TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot",
  "substate": "resolved",
  "severityRating": "Medium",
  "votes": 17,
  "disclosed": true,
  "disclosedAt": "2026-08-14T14:50:38.628Z",
  "programHandle": "nextcloud",
  "programName": "Nextcloud"
}

Example (leaderboard, ALL_TIME_REPUTATION):

{
  "itemType": "leaderboard-entry",
  "leaderboardKey": "ALL_TIME_REPUTATION",
  "rank": 1,
  "reputation": 219969,
  "username": "todayisnew",
  "name": "Eric",
  "profileUrl": "https://hackerone.com/todayisnew"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from the Storage → Dataset tab or via the API.

Example (programs, with programsIncludeScope/programsIncludeBountyTable):

{
  "itemType": "program-listing",
  "handle": "cloudflare",
  "name": "Cloudflare Public Bug Bounty",
  "offersBounties": true,
  "scope": [
    {
      "assetIdentifier": "dash.cloudflare.com",
      "assetType": "URL",
      "assetTypeLabel": "Domain",
      "maxSeverity": "critical",
      "eligibleForBounty": true,
      "eligibleForSubmission": true,
      "instruction": ""
    }
  ],
  "bountyTable": {
    "currency": "usd",
    "useRange": true,
    "rows": [
      { "assetIdentifier": null, "low": 500, "medium": 750, "high": 3000, "critical": 10000 }
    ]
  }
}

Data table

Field	Modes	Description
itemType	all	hacktivity-report / program-listing / leaderboard-entry / hacker-profile.
title, reportUrl, substate, severityRating, votes, disclosed(At)	hacktivity	Report detail (title/URL only populated once disclosed).
programHandle, programName, programUrl	hacktivity	Which program the report belongs to.
reporterUsername, reporterName	hacktivity	Who reported it.
fullReport (reportBody, humanSummaries, summary, severityRating, weakness, attachmentUrls, activityTimeline[].message, participants, visibility)	hacktivity (opt-in)	Full report write-up, human-authored team/researcher summaries, the discussion timeline with full comment/reply text, and the public participant list, for disclosed reports, when hacktivityIncludeFullReport: true. reportBody is empty when a program restricts disclosure to visibility: "no-content" (title/metadata only).
handle, name, offersBounties, baseBounty, resolvedReportCount, launchedAt	programs	Program directory attributes.
scope (assetIdentifier, assetType, maxSeverity, eligibleForBounty, eligibleForSubmission, instruction)	programs (opt-in)	Structured scope / target assets, when programsIncludeScope: true.
bountyTable (currency, useRange, rows[] with low/medium/high/critical)	programs (opt-in)	Bounty amounts by severity, when programsIncludeBountyTable: true.
rank, previousRank, reputation, signal, impact, votes	leaderboard	Ranking metrics (subset populated depends on leaderboardKey).
username, name, profileUrl, profilePicture	leaderboard, hackers	Researcher identity.
residence, completedPentests	hackers	Pentester directory attributes.
trackRecord (rank, reputation, signal/impactPercentile, resolvedReportCount, thanksReceivedCount, badges[], publicReviews[])	hackers (opt-in)	Public track record, when hackersIncludeTrackRecord: true.

Pricing

This Actor uses Pay-Per-Event pricing: you're charged per scraped row, by row type — hacktivity-report ($0.002, richest data), program-listing ($0.001), leaderboard-entry ($0.001), hacker-profile ($0.001) — plus opt-in enrichment charges only when the corresponding input flag is on and data was actually fetched: hacktivity-full-report ($0.003), program-scope-detail ($0.0025), hacker-track-record ($0.002). See the Pricing tab for the current rates. No compute-unit charges beyond the per-event price for typical runs.

Tips

• hacktivityDisclosedOnly: true filters out reports without full title/URL detail — use it if you only want fully readable disclosed reports.
• Combine hacktivitySearchQuery with hacktivityProgramHandle to narrow a single program's feed by severity, CWE, etc. (Hacktivity search syntax).
• The leaderboard is always capped at 100 entries by HackerOne itself — maxItems above 100 has no effect there.
• hackers mode returns HackerOne's public pentester directory, which is the only public directory of individual researchers HackerOne exposes beyond the leaderboard — see hackerone_api.md at the repo root for details on why a broader "hunters" list isn't offered. There is no hackersSearchQuery because the underlying pentester_profiles/leaderboard_entries GraphQL fields don't take a search argument at all (confirmed by extracting the real page's filter-building code — see hackerone_api.md); hackerone.com/directory/pentesters itself now 301-redirects to /leaderboard/pentesters, which has no search box either.
• programsSearchQuery searches the same text the real hackerone.com search box does: program name AND policy-page body text. A query like shopify therefore also surfaces programs that merely mention Shopify in their policy, not just the Shopify program itself — that's HackerOne's own search behavior, not a bug in this Actor.
• The three *Include* enrichment flags (programsIncludeScope, programsIncludeBountyTable, hackersIncludeTrackRecord, hacktivityIncludeFullReport) each cost one extra GraphQL call per row and default to false so a plain listing run stays fast and cheap. Turn them on only when you need the richer per-row data. Programs/reports/profiles that don't publicly expose that data (private/invite-only programs, undisclosed reports) simply get null/empty fields back, not an error.

Cyber recon toolkit

Part of the Cyber recon toolkit — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

• Bugcrowd Scraper — Scrapes public Bugcrowd data: disclosed submissions, program directory, leaderboard.
• Intigriti Scraper — Scrapes public Intigriti data: bug bounty/VDP program directory, researcher leaderboard and profiles.
• CVE Scraper — CVE.org vulnerability info scraper.
• TLSX - TLS Data Gathering and Analysis — Fast, configurable TLS grabber for TLS-based data collection and analysis.
• BGP.HE.NET Recon Scraper — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
• gau - Get All URLs — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
• Git Email Extractor — Shallow-clones git repos and extracts contributor emails from commit history.
• Wappalyzer Technology Lookup — Detect the technology stack behind any website using Wappalyzer.
• Meta Tags Scraper — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
• Universal Contact Extractor — Extract phone numbers, emails and social media URLs from web pages.
• Web Text Extractor — Extract clean text or Markdown content from web pages.

Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

FAQ & disclaimers

This Actor scrapes publicly accessible HackerOne data only — the public Hacktivity feed, the public program directory, the public leaderboard, and the public pentester directory. It does not require or store login credentials, does not access private programs or non-disclosed report content, and does not collect personal data beyond what HackerOne itself displays publicly on these pages. Use it in accordance with HackerOne's Terms of Service. Website structures and APIs can change — if the Actor stops returning data, please open an issue on the Actor's Issues tab. Need a custom variant (different fields, sites, or pipelines)? Reach out via Apify's custom development services.