Intigriti Scraper

Intigriti Scraper extracts publicly visible data from Intigriti, the European bug bounty / vulnerability disclosure platform, without logging in. It supports three modes: the public program directory (all open bug bounty and VDP programs, with industry, program type, and bounty range), the platform researcher leaderboard (top ranked ethical hackers, all-time or last-90-days), and public researcher profiles (reputation, rank, submission stats, skills, achievements, and program contributions). Run it on the Apify platform for scheduling, API access, webhooks, and dataset export.

Only anonymous, publicly-accessible Intigriti data is scraped — no login, no session cookies, no authenticated Intigriti "researcher API" or "company API" token is used or required, and no private/invite-only program data or non-public submission content is accessed.

Why use Intigriti Scraper?

• Bug bounty market research — track how many programs Intigriti hosts, in which industries, and at what bounty ranges, over time.
• Competitive/vendor security posture — see whether a specific company runs a public VDP or bug bounty program on Intigriti, and what its scope/type looks like.
• Researcher community analysis — see who the top-ranked ethical hackers are and how active they are, for recruiting, community-building, or research purposes.
• Lead lists — feed structured program/company data into a sales or research pipeline.

How to use Intigriti Scraper

1. Click Try for free (or Run) on this Actor's page.
2. Pick a Mode: programs, leaderboard, or researchers.
3. For programs, optionally set a Search query, Industry, or Program type filter.
4. For leaderboard/researchers, optionally set Timeframe (alltime/ninetydays) and Severity. For researchers, optionally supply specific Researcher usernames — if left empty, the top researchers from the public leaderboard are used automatically, and you can narrow that list with Researcher handle search (a partial, case-insensitive match).
5. Set Max items (0 = unlimited, where applicable).
6. Click Start and watch results land in the dataset in real time.

Input

Field	Type	Applies to	Description
mode	string	all	programs, leaderboard, or researchers.
maxItems	integer	all	Max items to scrape (0 = unlimited). Default 50.
searchQuery	string	programs	Free-text search against the program directory.
industry	string	programs	Filter by industry name (e.g. Software).
programType	string	programs	Bug bounty program or Responsible disclosure.
programsIncludeScope	boolean	programs	Fetch each program's target-asset scope (1 extra request/program, shared with programsIncludeBountyTable/programsIncludeProgramStats). Default false.
programsIncludeBountyTable	boolean	programs	Fetch each program's per-severity bounty tier table (shares the request above). Default false.
programsIncludeProgramStats	boolean	programs	Add submission/payout counters, flags, and a public recent-activity feed (shares the request above). Default false.
programsIncludeLeaderboard	boolean	programs	Fetch each program's public per-program leaderboard (1 extra request/program, shared with programsIncludeResponseTimes). Default false.
programsIncludeResponseTimes	boolean	programs	Fetch each program's public 90-day average response-time stats (shares the request above). Default false.
startPage	integer	programs	0-indexed directory page to start from. Default 0.
timeframe	string	leaderboard, researchers	alltime or ninetydays. Default alltime.
severity	integer	leaderboard, researchers	Which public leaderboard board to fetch: 1 = all severities, 2 = high-to-exceptional severity only. Default 1.
usernames	array	researchers	Specific handles to scrape. Empty = use the public leaderboard.
researchersSearchQuery	string	researchers	Case-insensitive partial-handle match against the public leaderboard (only used when usernames is empty).
proxyConfiguration	object	all	Optional proxy config. No proxy used by default (see Tips).

See the Input tab for the full schema with defaults.

Output

Each dataset item is one program, leaderboard entry, or researcher profile, depending on mode.

Program example:

{
  "itemType": "program",
  "programId": "d3bee5a5-9107-4e71-8d94-ab5098f2005c",
  "programName": "Dutch Lottery VDP",
  "companyHandle": "nederlandseloterij",
  "companyName": "Nederlandse Loterij",
  "industryName": "Media and Entertainment",
  "programType": "Responsible disclosure",
  "minBountyValue": 0,
  "maxBountyValue": 0,
  "bountyCurrency": "EUR",
  "programUrl": "https://app.intigriti.com/programs/nederlandseloterij/dutchlotteryvdp/detail"
}

Program example with programsIncludeScope + programsIncludeBountyTable enabled (fields truncated for brevity):

{
  "itemType": "program",
  "programName": "NVIDIA Public Bug Bounty",
  "companyHandle": "nvidia",
  "companyName": "NVIDIA",
  "scope": [
    {
      "assetIdentifier": "NVCC",
      "assetType": "other",
      "tier": 3,
      "inScope": true,
      "description": "NVCC is the CUDA Compiler Driver..."
    }
  ],
  "bountyTiers": {
    "4": {
      "currency": "USD",
      "low": { "min": 300, "max": 300 },
      "medium": { "min": 2000, "max": 2000 },
      "high": { "min": 4000, "max": 4000 },
      "critical": { "min": 15000, "max": 15000 },
      "exceptional": { "min": 15000, "max": 15000 }
    }
  }
}

scope is empty ([]) and bountyTiers is empty ({}) when the program's public detail payload couldn't be fetched (see Tips below) -- the row is never dropped or the run crashed.

Program example with programsIncludeProgramStats + programsIncludeLeaderboard + programsIncludeResponseTimes enabled (fields truncated for brevity):

{
  "itemType": "program",
  "programName": "NVIDIA Public Bug Bounty",
  "programStats": {
    "submissionCount": 0,
    "acceptedSubmissionCount": 0,
    "totalPayout": null,
    "averagePayout": null,
    "awardRep": true,
    "allowCollaboration": true,
    "skipTriage": false,
    "hasUpdates": false,
    "statusId": 3,
    "confidentialityLevelId": 4,
    "recentActivity": [
      { "timestamp": 1786866308, "activityTypeId": 9, "researcherHandle": "0xlazyaudit", "researcherIdentityChecked": false, "companyName": null }
    ],
    "recentContributors": [
      { "handle": "ngosytuan", "identityChecked": true }
    ]
  },
  "topResearchers": [
    { "rank": 1, "handle": "predato97", "reputation": null, "streak": null, "identityChecked": true }
  ],
  "responseTimes90d": {
    "firstRespondedSeconds": 1017067,
    "handledByTriageSeconds": 1480674,
    "handledByCompanySeconds": 3520787
  }
}

Leaderboard example:

{
  "itemType": "leaderboard-entry",
  "rank": 1,
  "handle": "vampire01",
  "profileUrl": "https://app.intigriti.com/profile/vampire01",
  "reputation": 18692,
  "streak": 5,
  "identityChecked": true
}

Researcher profile example:

{
  "itemType": "researcher-profile",
  "handle": "predato97",
  "userId": "c75a78e5-6b9e-4593-8463-6311c9a95342",
  "profileUrl": "https://app.intigriti.com/profile/predato97",
  "reputation": 150,
  "rank": 1220,
  "streak": 4,
  "totalSubmissions": 13,
  "acceptedSubmissions": 10,
  "rejectedSubmissions": 2,
  "validSubmissionRatio": 100,
  "website": "hackerone.com/predator_97",
  "twitter": "predator_97x",
  "recentActivity": [
    { "timestamp": 1785956622, "activityTypeId": 2, "newStatusId": 3, "programName": "NVIDIA Public Bug Bounty", "companyName": "Nvidia" }
  ],
  "lastContributionPrograms": [
    { "programName": "NVIDIA Public Bug Bounty", "programUrl": "https://app.intigriti.com/programs/nvidia/nvidiapublicbugbounty/detail" }
  ],
  "achievements": [
    { "id": "ten_valid_submission", "goal": 10, "progress": 12, "isUnlocked": true, "unlockedAt": 1785441062 }
  ],
  "highlightedAchievements": ["program_top_one", "program_top_ten", "high_severity"],
  "externalAccounts": [
    { "platform": "hackerone", "handle": "predator_97", "verified": true, "allTimeRank": 1179, "allTimeReputation": 2310 }
  ],
  "certifications": [],
  "skills": ["api", "cloud_hacking", "mobile_hacking", "web_hacking", "supply_chain", "source_code_review"],
  "industries": ["software", "retail", "financial_services_and_insurance"]
}

researchers mode fetches this from the same public JSON APIs the real profile page itself calls (not by scraping HTML) -- see intigriti_api_notes.md for the full endpoint writeup. achievements is the complete achievement catalog (not just the "highlighted" ones), and recentActivity is a full per-program submission/status-change timeline.

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from the Storage → Dataset tab or via the API.

Data table

Field	Modes	Description
itemType	all	program, leaderboard-entry, or researcher-profile.
programName, companyName, industryName, programType	programs	Program naming and taxonomy.
minBountyValue, maxBountyValue, bountyCurrency	programs	Advertised bounty range.
programUrl	programs, researchers	Link to the program's public detail page.
scope	programs	Target assets (assetIdentifier, assetType, tier, inScope, description). Only when programsIncludeScope is enabled.
bountyTiers	programs	Per-tier payout ranges by severity (low/medium/high/critical/exceptional) plus currency. Only when programsIncludeBountyTable is enabled.
programStats	programs	Submission/payout counters, flags, recent public activity feed, recent contributors. Only when programsIncludeProgramStats is enabled.
topResearchers	programs	Top researchers ranked on this specific program. Only when programsIncludeLeaderboard is enabled.
responseTimes90d	programs	90-day average first-response/triage/decision times, in seconds. Only when programsIncludeResponseTimes is enabled.
rank, handle, reputation	leaderboard, researchers	Ranking and points.
totalSubmissions, acceptedSubmissions, rejectedSubmissions, validSubmissionRatio	researchers	Exact submission track record.
recentActivity	researchers	Full per-program submission/status-change timeline with timestamps.
lastContributionPrograms, topContributionPrograms	researchers	Programs the researcher has contributed accepted findings to.
achievements, highlightedAchievements	researchers	Complete achievement catalog (id, goal, progress, isUnlocked, unlockedAt) plus the highlighted subset.
externalAccounts	researchers	Linked external-platform (HackerOne/Bugcrowd) rank & reputation, where verified.
certifications, skills, industries	researchers	Certifications and self-selected skill/industry interest tags.

Pricing

This Actor uses Apify's Pay-per-event pricing. You are charged per scraped row, not per platform compute unit:

Event	Price	Mode
Program directory row	$0.0015	programs
Program scope/bounty/stats detail	$0.0025	programs (only when programsIncludeScope, programsIncludeBountyTable, and/or programsIncludeProgramStats are enabled; charged once per program, not per flag)
Program leaderboard/response-time detail	$0.002	programs (only when programsIncludeLeaderboard and/or programsIncludeResponseTimes are enabled; charged once per program, not per flag)
Leaderboard entry	$0.0007	leaderboard
Researcher profile	$0.003	researchers (full activity timeline, complete achievement catalog, linked external-platform stats included at no extra charge)

Since these pages are lightweight JSON/HTML (no browser rendering needed), a typical run of a few hundred items usually finishes in well under a minute of compute.

Tips

• The public platform leaderboard API caps results at 100 rows per (timeframe, severity) combination — leaderboard and the auto-populated part of researchers mode are capped there, not by maxItems.
• Combine searchQuery, industry, and programType to narrow the program directory before paginating through all pages. searchQuery calls the same public Algolia search index the site's own search box uses (confirmed live: an empty query returns all 180 programs, while searchQuery: "bank" narrows that to 18 -- Delen Private Bank, Monzo Bank, TrueLayer, Revolut, Belfius, and more).
• researchers mode is fastest when you already know the handles you want (usernames) — it then skips the leaderboard lookup entirely. To find a researcher by partial name instead, leave usernames empty and set researchersSearchQuery — it filters the public leaderboard's up-to-100 rows by substring match on handle, same as that page's own filter box.
• programsIncludeScope/programsIncludeBountyTable/programsIncludeProgramStats fetch each program's public detail page (app.intigriti.com/api/core/public/programs/<companyHandle>/<handle>) — this can occasionally return no data for a given program (bot-detection on that endpoint blocks a handful of programs consistently; not transient), in which case the row still ships with scope: [] / bountyTiers: {} / programStats: null and a warning is logged, rather than failing the run. See intigriti_api_notes.md in the repo for endpoint details.

Cyber recon toolkit

Part of the Cyber recon toolkit — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

• Bugcrowd Scraper — Scrapes public Bugcrowd data: disclosed submissions, program directory, leaderboard.
• HackerOne Scraper — Scrapes public HackerOne data: Hacktivity disclosed reports, program directory, researcher leaderboard.
• CVE Scraper — CVE.org vulnerability info scraper.
• TLSX - TLS Data Gathering and Analysis — Fast, configurable TLS grabber for TLS-based data collection and analysis.
• BGP.HE.NET Recon Scraper — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
• gau - Get All URLs — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
• Git Email Extractor — Shallow-clones git repos and extracts contributor emails from commit history.
• Wappalyzer Technology Lookup — Detect the technology stack behind any website using Wappalyzer.
• Meta Tags Scraper — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
• Universal Contact Extractor — Extract phone numbers, emails and social media URLs from web pages.
• Web Text Extractor — Extract clean text or Markdown content from web pages.

Did you find this useful?

⭐ Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

FAQ & disclaimers

This Actor scrapes only publicly accessible Intigriti data — the public program directory (intigriti.com/researchers/bug-bounty-programs), the public platform leaderboard, public per-program leaderboards/response-time stats, and public researcher profile data (all served by unauthenticated JSON endpoints that intigriti.com's own frontend itself calls). It does not log in, does not use or require an Intigriti API token, and does not access private/invite-only program details or non-public vulnerability report content. Intigriti does not currently publish a public disclosed-report ("Hacktivity"-style) feed, so that data is not available to scrape and is not included here — re-verified with a full real-browser network capture, see intigriti_api_notes.md. Use this Actor in accordance with Intigriti's Terms of Service. Website/API structures can change — if the Actor stops returning data, please open an issue on the Actor's Issues tab. Need a custom variant (different fields, sites, or pipelines)? Reach out via Apify's custom development services.