# HackerOne Scraper (`rl1987/hackerone-scraper`) Actor

Scrapes public HackerOne data: the Hacktivity disclosed-report feed, the public bug bounty program directory, the public researcher leaderboard, and the public pentester directory.

- **URL**: https://apify.com/rl1987/hackerone-scraper.md
- **Developed by:** [R.L.](https://apify.com/rl1987) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 hacktivity reports

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

**HackerOne Scraper** extracts public data from [HackerOne](https://hackerone.com), the
leading bug bounty and vulnerability disclosure platform, by calling HackerOne's own
web-app GraphQL API directly — the same API `hackerone.com` itself uses, reverse
engineered from its frontend JS bundle (see `hackerone_api.md` at the repo root). It's
fast and doesn't render pages in a browser. Four modes are supported: the **Hacktivity**
disclosed-vulnerability-report feed, the public **program directory**, the public
**leaderboard** of top researchers, and the public **pentester/hacker directory**. Run
it on the Apify platform to get scheduling, API access, webhooks, and dataset export.

**Important:** this Actor only accesses **public** HackerOne data — the public
Hacktivity feed, the public program directory, the public leaderboard, and the public,
opt-in pentester directory. It does not log in, does not require credentials, and
cannot access private programs, private/non-disclosed report content, or any
authenticated-only data.

### Why use HackerOne Scraper?

- **Security research** — track newly disclosed vulnerability classes, CWEs, and
  severities across the whole HackerOne ecosystem or a specific program.
- **Bug bounty market research** — see which programs pay bounties, how much, and how
  many reports they've resolved, to plan where to focus hunting effort.
- **Competitive/vendor risk monitoring** — watch a specific vendor's disclosed reports
  and program health over time.
- **Community/talent insight** — pull top-researcher leaderboards and public pentester
  profiles for recruiting or community analysis.

### How to use HackerOne Scraper

1. Click **Try for free** (or **Run**) on this Actor's page.
2. Pick a **Mode**: `hacktivity`, `programs`, `leaderboard`, or `hackers`.
3. Set the mode-specific filters (see **Input** below) and a **Max items** cap (`0` =
   unlimited, except leaderboard which HackerOne itself caps at 100 entries).
4. Click **Start** and watch results land in the dataset in real time.

### Input

| Field | Type | Description |
|---|---|---|
| `mode` | string | One of `hacktivity`, `programs`, `leaderboard`, `hackers`. |
| `maxItems` | integer | Max items to scrape (0 = unlimited). Default `100`. |
| `hacktivitySearchQuery` | string | *(hacktivity)* Raw Hacktivity search syntax, e.g. `severity_rating:critical`. |
| `hacktivityProgramHandle` | string | *(hacktivity)* Restrict to one program, e.g. `curl`. |
| `hacktivityDisclosedOnly` | boolean | *(hacktivity)* Only publicly disclosed reports. Default `false`. |
| `hacktivityPageSize` | integer | *(hacktivity)* Items per page. Default `25`. |
| `hacktivityIncludeFullReport` | boolean | *(hacktivity)* For disclosed reports, fetch the full report write-up, human-authored team/researcher summaries, the public participant list, severity/weakness/attachments, and the full activity/discussion timeline including comment/reply text (2 extra calls per disclosed report). Default `false`. |
| `programsSearchQuery` | string | *(programs)* Free-text search, matching the real search box on hackerone.com/directory/programs — case-insensitive substring match against the program name and its policy text (and the equivalent fields on `external_program` for VDP-only listings). Combined with `programsOffersBounties` using AND. |
| `programsOffersBounties` | string | *(programs)* `any` / `true` / `false`. Default `any`. |
| `programsIncludeScope` | boolean | *(programs)* Fetch each program's structured scope / target assets (1 extra call per program). Default `false`. |
| `programsIncludeBountyTable` | boolean | *(programs)* Fetch each program's bounty table by severity (1 extra call per program). Default `false`. |
| `leaderboardKey` | string | *(leaderboard)* Which ranking, e.g. `ALL_TIME_REPUTATION`, `HIGHEST_REPUTATION`, `CTF_POINTS`, ... |
| `leaderboardUserType` | string | *(leaderboard)* Optional user type filter. |
| `leaderboardYear` | integer | *(leaderboard)* Required for every key except `ALL_TIME_REPUTATION`. |
| `leaderboardQuarter` | integer | *(leaderboard)* Optional quarter (1-4). |
| `hackersPageSize` | integer | *(hackers)* Items per page. Default `25`. |
| `hackersIncludeTrackRecord` | boolean | *(hackers)* Fetch each hacker's public track record: rank, reputation, signal/impact percentiles, resolved report count, badges, reviews (1 extra call per hacker). Default `false`. |
| `proxyConfiguration` | object | Proxy config. No proxy is used by default — HackerOne's public GraphQL API was not observed to block plain datacenter requests. |

See the **Input** tab for the full schema with defaults.

### Output

Each dataset item is one row, tagged with `itemType`. Example (`hacktivity`, disclosed):

```json
{
  "itemType": "hacktivity-report",
  "id": "3799010",
  "reportUrl": "https://hackerone.com/reports/3799010",
  "title": "TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot",
  "substate": "resolved",
  "severityRating": "Medium",
  "votes": 17,
  "disclosed": true,
  "disclosedAt": "2026-08-14T14:50:38.628Z",
  "programHandle": "nextcloud",
  "programName": "Nextcloud"
}
```

Example (`leaderboard`, `ALL_TIME_REPUTATION`):

```json
{
  "itemType": "leaderboard-entry",
  "leaderboardKey": "ALL_TIME_REPUTATION",
  "rank": 1,
  "reputation": 219969,
  "username": "todayisnew",
  "name": "Eric",
  "profileUrl": "https://hackerone.com/todayisnew"
}
```

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from
the **Storage → Dataset** tab or via the API.

Example (`programs`, with `programsIncludeScope`/`programsIncludeBountyTable`):

```json
{
  "itemType": "program-listing",
  "handle": "cloudflare",
  "name": "Cloudflare Public Bug Bounty",
  "offersBounties": true,
  "scope": [
    {
      "assetIdentifier": "dash.cloudflare.com",
      "assetType": "URL",
      "assetTypeLabel": "Domain",
      "maxSeverity": "critical",
      "eligibleForBounty": true,
      "eligibleForSubmission": true,
      "instruction": ""
    }
  ],
  "bountyTable": {
    "currency": "usd",
    "useRange": true,
    "rows": [
      { "assetIdentifier": null, "low": 500, "medium": 750, "high": 3000, "critical": 10000 }
    ]
  }
}
```

### Data table

| Field | Modes | Description |
|---|---|---|
| `itemType` | all | `hacktivity-report` / `program-listing` / `leaderboard-entry` / `hacker-profile`. |
| `title`, `reportUrl`, `substate`, `severityRating`, `votes`, `disclosed(At)` | hacktivity | Report detail (title/URL only populated once disclosed). |
| `programHandle`, `programName`, `programUrl` | hacktivity | Which program the report belongs to. |
| `reporterUsername`, `reporterName` | hacktivity | Who reported it. |
| `fullReport` (`reportBody`, `humanSummaries`, `summary`, `severityRating`, `weakness`, `attachmentUrls`, `activityTimeline[].message`, `participants`, `visibility`) | hacktivity (opt-in) | Full report write-up, human-authored team/researcher summaries, the discussion timeline with full comment/reply text, and the public participant list, for disclosed reports, when `hacktivityIncludeFullReport: true`. `reportBody` is empty when a program restricts disclosure to `visibility: "no-content"` (title/metadata only). |
| `handle`, `name`, `offersBounties`, `baseBounty`, `resolvedReportCount`, `launchedAt` | programs | Program directory attributes. |
| `scope` (`assetIdentifier`, `assetType`, `maxSeverity`, `eligibleForBounty`, `eligibleForSubmission`, `instruction`) | programs (opt-in) | Structured scope / target assets, when `programsIncludeScope: true`. |
| `bountyTable` (`currency`, `useRange`, `rows[]` with `low`/`medium`/`high`/`critical`) | programs (opt-in) | Bounty amounts by severity, when `programsIncludeBountyTable: true`. |
| `rank`, `previousRank`, `reputation`, `signal`, `impact`, `votes` | leaderboard | Ranking metrics (subset populated depends on `leaderboardKey`). |
| `username`, `name`, `profileUrl`, `profilePicture` | leaderboard, hackers | Researcher identity. |
| `residence`, `completedPentests` | hackers | Pentester directory attributes. |
| `trackRecord` (`rank`, `reputation`, `signal`/`impactPercentile`, `resolvedReportCount`, `thanksReceivedCount`, `badges[]`, `publicReviews[]`) | hackers (opt-in) | Public track record, when `hackersIncludeTrackRecord: true`. |

### Pricing

This Actor uses **Pay-Per-Event** pricing: you're charged per scraped row, by row type
— `hacktivity-report` ($0.002, richest data), `program-listing` ($0.001),
`leaderboard-entry` ($0.001), `hacker-profile` ($0.001) — plus opt-in enrichment
charges only when the corresponding input flag is on and data was actually fetched:
`hacktivity-full-report` ($0.003), `program-scope-detail` ($0.0025), `hacker-track-record`
($0.002). See the **Pricing** tab for the current rates. No compute-unit charges beyond
the per-event price for typical runs.

### Tips

- `hacktivityDisclosedOnly: true` filters out reports without full title/URL detail —
  use it if you only want fully readable disclosed reports.
- Combine `hacktivitySearchQuery` with `hacktivityProgramHandle` to narrow a single
  program's feed by severity, CWE, etc. (Hacktivity search syntax).
- The leaderboard is always capped at 100 entries by HackerOne itself — `maxItems` above
  100 has no effect there.
- `hackers` mode returns HackerOne's public pentester directory, which is the only
  public directory of individual researchers HackerOne exposes beyond the leaderboard —
  see `hackerone_api.md` at the repo root for details on why a broader "hunters" list
  isn't offered. There is no `hackersSearchQuery` because the underlying
  `pentester_profiles`/`leaderboard_entries` GraphQL fields don't take a search
  argument at all (confirmed by extracting the real page's filter-building code — see
  `hackerone_api.md`); `hackerone.com/directory/pentesters` itself now 301-redirects to
  `/leaderboard/pentesters`, which has no search box either.
- `programsSearchQuery` searches the same text the real hackerone.com search box does:
  program name AND policy-page body text. A query like `shopify` therefore also
  surfaces programs that merely *mention* Shopify in their policy, not just the Shopify
  program itself — that's HackerOne's own search behavior, not a bug in this Actor.
- The three `*Include*` enrichment flags (`programsIncludeScope`,
  `programsIncludeBountyTable`, `hackersIncludeTrackRecord`,
  `hacktivityIncludeFullReport`) each cost one extra GraphQL call per row and default to
  `false` so a plain listing run stays fast and cheap. Turn them on only when you need
  the richer per-row data. Programs/reports/profiles that don't publicly expose that
  data (private/invite-only programs, undisclosed reports) simply get `null`/empty
  fields back, not an error.

### Cyber recon toolkit

Part of the **Cyber recon toolkit** — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

- [Bugcrowd Scraper](https://apify.com/rl1987/bugcrowd-scraper) — Scrapes public Bugcrowd data: disclosed submissions, program directory, leaderboard.
- [Intigriti Scraper](https://apify.com/rl1987/intigriti-scraper) — Scrapes public Intigriti data: bug bounty/VDP program directory, researcher leaderboard and profiles.
- [CVE Scraper](https://apify.com/rl1987/cve-scraper) — CVE.org vulnerability info scraper.
- [TLSX - TLS Data Gathering and Analysis](https://apify.com/rl1987/pd-tlsx) — Fast, configurable TLS grabber for TLS-based data collection and analysis.
- [BGP.HE.NET Recon Scraper](https://apify.com/rl1987/bgphenet-scraper) — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
- [gau - Get All URLs](https://apify.com/rl1987/gau-wrapper) — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
- [Git Email Extractor](https://apify.com/rl1987/git-email-extractor) — Shallow-clones git repos and extracts contributor emails from commit history.
- [Wappalyzer Technology Lookup](https://apify.com/rl1987/wappalyzer-tech-lookup) — Detect the technology stack behind any website using Wappalyzer.
- [Meta Tags Scraper](https://apify.com/rl1987/meta-tags-scraper) — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
- [Universal Contact Extractor](https://apify.com/rl1987/universal-contact-extractor) — Extract phone numbers, emails and social media URLs from web pages.
- [Web Text Extractor](https://apify.com/rl1987/web-text-extractor) — Extract clean text or Markdown content from web pages.

### Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

### FAQ & disclaimers

This Actor scrapes publicly accessible HackerOne data only — the public Hacktivity
feed, the public program directory, the public leaderboard, and the public pentester
directory. It does not require or store login credentials, does not access private
programs or non-disclosed report content, and does not collect personal data beyond
what HackerOne itself displays publicly on these pages. Use it in accordance with
HackerOne's Terms of Service. Website structures and APIs can change — if the Actor
stops returning data, please open an issue on the Actor's Issues tab. Need a custom
variant (different fields, sites, or pipelines)? Reach out via Apify's custom
development services.

# Actor input Schema

## `mode` (type: `string`):

Which public HackerOne data set to scrape.

## `maxItems` (type: `integer`):

Maximum number of items to scrape. Set to 0 for unlimited (walks every page until exhausted). Note: the leaderboard mode is always capped at 100 entries by HackerOne itself, regardless of this setting.

## `hacktivitySearchQuery` (type: `string`):

Optional raw Hacktivity search syntax (the same query language as the search box on hackerone.com/hacktivity), e.g. "severity\_rating:critical". Combined with programHandle/disclosedOnly below using AND.

## `hacktivityProgramHandle` (type: `string`):

Only return reports for this program, e.g. "curl" for hackerone.com/curl. Leave empty for all programs.

## `hacktivityDisclosedOnly` (type: `boolean`):

Only return reports that have been publicly disclosed (these are the ones with full report titles/URLs; non-disclosed reports only expose metadata such as votes, program, and timestamps).

## `hacktivityPageSize` (type: `integer`):

Number of Hacktivity items requested per page.

## `hacktivityIncludeFullReport` (type: `boolean`):

For publicly disclosed reports only, fetch the full report write-up (reportBody), human-authored team/researcher summaries (humanSummaries), the public participant list, severity/weakness/attachments, and the full activity/discussion timeline including comment/reply message text (activityTimeline\[].message). Costs one extra REST call plus one extra GraphQL call per disclosed report (slower, and triggers the hacktivity-full-report charge), so it defaults to off.

## `programsSearchQuery` (type: `string`):

Free-text search, matching the real search box on hackerone.com/directory/programs. Case-insensitive substring match against the program's name and its policy page text (and, for external/VDP-only programs, the same two fields on their external program record) -- e.g. "shopify" returns the Shopify program itself plus other programs whose policy mentions Shopify. Combined with Offers bounties below using AND.

## `programsOffersBounties` (type: `string`):

Filter the program directory by whether the program pays cash bounties.

## `programsIncludeScope` (type: `boolean`):

Fetch each program's structured scope (target assets: URL/source code/mobile app/etc., asset identifier, eligibility for bounty/submission, max severity, instructions) from its public policy/scope page. Costs one extra GraphQL call per program (slower, and triggers the program-scope-detail charge), so it defaults to off. Programs that don't expose public scope (private/invite-only) get an empty scope list, not an error.

## `programsIncludeBountyTable` (type: `boolean`):

Fetch each program's bounty table (reward amounts per severity: low/medium/high/critical, plus currency) from its public policy page. Costs one extra GraphQL call per program (slower, and triggers the program-scope-detail charge), so it defaults to off. Programs without a public bounty table (VDP-only / private) get a null bountyTable, not an error.

## `leaderboardKey` (type: `string`):

Which leaderboard ranking to scrape. All-time reputation needs no time range. All other keys are time-scoped and require leaderboardYear (optionally + leaderboardQuarter) to be set.

## `leaderboardUserType` (type: `string`):

Optionally restrict to a HackerOne user type, e.g. "hacker". Leave empty for the default (all).

## `leaderboardYear` (type: `integer`):

Required for all leaderboard keys except ALL\_TIME\_REPUTATION, e.g. 2026.

## `leaderboardQuarter` (type: `integer`):

Optional quarter (1-4) to further scope a time-based leaderboard. Leave empty for the full year.

## `hackersPageSize` (type: `integer`):

Number of pentester-directory profiles requested per page.

## `hackersIncludeTrackRecord` (type: `boolean`):

Fetch each hacker's public track record from their profile page: rank, reputation, signal/impact (with percentiles), resolved report count, thanks received, badges, and public program reviews. Costs one extra GraphQL call per hacker (slower, and triggers the hacker-track-record charge), so it defaults to off.

## `proxyConfiguration` (type: `object`):

HackerOne's public GraphQL endpoint was not observed to block or rate-limit plain requests from a datacenter IP, so no proxy is used by default. Enable one here if you start seeing blocking.

## Actor input object example

```json
{
  "mode": "hacktivity",
  "maxItems": 100,
  "hacktivityDisclosedOnly": false,
  "hacktivityPageSize": 25,
  "hacktivityIncludeFullReport": false,
  "programsOffersBounties": "any",
  "programsIncludeScope": false,
  "programsIncludeBountyTable": false,
  "leaderboardKey": "ALL_TIME_REPUTATION",
  "hackersPageSize": 25,
  "hackersIncludeTrackRecord": false,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `items` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("rl1987/hackerone-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("rl1987/hackerone-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call rl1987/hackerone-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rl1987/hackerone-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/k4ZdJwxVfbTf8CUbH/builds/PB8LC3Qr0S8FBn43v/openapi.json