# HackenProof Bug Bounty & Audit Program Scraper (`tactful_anvil/hackenproof-bug-bounty-scraper`) Actor

Scrape every HackenProof bug bounty and audit program: max bounty, total paid out to researchers (payout proof), submitted-report count (competition), triage flag, project types, languages and platforms. Paid-per-report + 0-100 opportunity score rank 300+ programs. HTTP-only, no login.

- **URL**: https://apify.com/tactful\_anvil/hackenproof-bug-bounty-scraper.md
- **Developed by:** [Mr Zack](https://apify.com/tactful_anvil) (community)
- **Categories:** Developer tools, Automation, Lead generation
- **Stats:** 2 total users, 1 monthly users, 60.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.95 / 1,000 program results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## HackenProof Bug Bounty Scraper - Payout Proof & Competition Signals

Get **every HackenProof bug bounty and audit program** as clean structured data in one run: max bounty, project types, languages, platforms, triage flag, start/updated dates and status.

Then - the part no other scraper gives you - the two numbers HackenProof publishes that **Immunefi and most platforms hide**:

- **`totalPaidUsd`** - how much the program has *actually paid out* to researchers, and
- **`submittedReports`** - how many reports you are competing against.

Divide one by the other and you know what an average submission earned (`paidPerReportUsd`) before you spend a weekend on scope. One run = the full directory (300+ programs, ~$11.5M in tracked public payouts), filterable, scored and sorted.

### Who is this for?

- **Web3 security researchers & bug bounty hunters** - stop guessing which "up to $250,000" program has actually paid anyone. Filter `onlyProvenPayout`, sort by `paidPerReport`, cap the competition with `maxSubmittedReports`.
- **Security teams & agencies** - benchmark bounty sizes, payout behaviour and report volume across 300+ programs before advising clients.
- **Analysts & builders** - the web3 security market as a dataset: track new program launches, payout velocity and platform trends.
- **AI agents (MCP)** - pay-per-event Actors are callable as tools. *"Find live Solana programs that have paid at least $10k out, with under 200 reports submitted"* becomes one tool call.

### What makes this Actor different

**Payout proof, not payout promises.** A program advertising "up to $250,000" that has paid $0 across 600 reports is a very different bet from one that has paid $147,300 against a $2,000 max. HackenProof publishes both numbers; this Actor turns them into sortable signals:

| Question a hunter asks | Field that answers it |
| --- | --- |
| Has this program ever actually paid anyone? | `payoutProven`, `totalPaidUsd` |
| What did an average report here earn? | `paidPerReportUsd` |
| How many hunters am I competing with? | `submittedReports`, `competitionBucket` |
| Is the program alive or quietly abandoned? | `status`, `daysSinceUpdate` |
| Will my report get triaged professionally? | `triagedByHackenproof` |
| Just tell me what to hunt this weekend. | `opportunityScore` - 0-100, sortable |

### Output (one item per program)

| Field | Example | Notes |
| --- | --- | --- |
| `name` | `NEAR Intents: Bridges` | |
| `programUrl` | `https://hackenproof.com/programs/near-intents-bridges` | |
| `programType` | `bounty` | `bounty` or `audit` |
| `status` | `live` | `live` / `paused` / `ended` |
| `maxBountyUsd` | `300000` | published maximum |
| `totalPaidUsd` | `45200` | **payout proof** - null when the program keeps it private |
| `paidIsPrivate` | `false` | |
| `payoutProven` | `true` | paid > $0; `null` when private (we never guess) |
| `paidPerReportUsd` | `83.09` | naive but honest: total paid / reports |
| `submittedReports` | `544` | competition signal |
| `competitionBucket` | `high` | `none` / `low` / `moderate` / `high` / `brutal` |
| `opportunityScore` | `78.4` | 0-100 composite, see below |
| `startedAt`, `lastUpdatedAt`, `endsAt` | ISO dates | |
| `ageDays`, `daysSinceUpdate` | `165`, `81` | freshness |
| `triagedByHackenproof` | `true` | |
| `projectTypes`, `categories`, `languages`, `platforms` | `["Bridge"]`, `["Web"]`, `["Rust"]`, `["Near"]` | |
| `raw` | original strings | exact values as displayed on the site |

Any field the site does not publish comes back `null` - **never a fabricated zero**.

#### How the opportunity score works

Deliberately simple, documented, and reproducible so you can argue with it:

- **40% max bounty** - sqrt-scaled, saturating at $100,000
- **25% payout proof** - paid > $0 scales with the amount (saturating at $25k); a private total counts as neutral 0.5; a public $0 scores 0 on this component
- **20% low competition** - decays as reports pile in (300 reports = half marks)
- **15% freshness** - live and recently updated; paused programs are penalised, ended ones get 0

Programs with no published max bounty score `null` rather than a misleading number. Unproven programs still rank - they just do not outrank programs that provably pay.

### Input highlights

- `status` - `live` (default) or `all`
- `onlyProvenPayout` - only programs that have publicly paid > $0
- `minMaxBountyUsd`, `maxSubmittedReports`, `maxDaysSinceUpdate`, `triagedOnly`
- `projectTypes`, `languages`, `platforms`, `searchText` - slice the directory
- `sortBy` - `opportunity` (default), `maxBounty`, `totalPaid`, `paidPerReport`, `fewestReports`, `newest`, `recentlyUpdated`
- `maxItems` - you are only charged for returned results

#### Example: the proven-payer, low-competition query

```json
{
  "status": "live",
  "onlyProvenPayout": true,
  "minMaxBountyUsd": 10000,
  "maxSubmittedReports": 200,
  "sortBy": "paidPerReport",
  "maxItems": 25
}
```

Live programs that have really paid researchers, with $10k+ max bounties and fewer than 200 competing reports - ranked by what an average report earned.

### How to schedule this Actor (recommended setup)

New programs launch weekly, payout totals and report counts move daily, and the best programs saturate fast. A scheduled run is how you catch a fresh program before 500 hunters do.

1. Run the Actor once with the input you want and check the results.
2. On the Actor page open the **...** menu and choose **Schedule Actor** (or go to [Schedules](https://console.apify.com/schedules) and click **Create new**).
3. Set the cron expression:
   - `0 7 * * *` - every morning. Cheapest useful cadence.
   - `0 */12 * * *` - twice a day, for catching new launches early.
   - `0 7 * * 1` - weekly digest, if you only hunt weekends.
4. Attach the saved input. A tight input (`maxItems: 25`, `sortBy: "opportunity"`) keeps every scheduled run to a few cents.
5. Add an integration: **Integrations** → **Slack / Webhook / Google Sheets / Zapier / Make**, triggered on *Run succeeded*. Your ranked feed of programs arrives on its own.

**Catching launches:** combine `sortBy: "newest"` with `maxItems: 20` on a daily schedule - new programs surface before the report count climbs. Add `maxSubmittedReports: 50` and every item in your inbox is a program almost nobody has hit yet.

### Why this Actor

- **HTTP-only, no browser** - the full directory in under a minute, cheap to run.
- **Defensive parser** - tolerates site structure drift; failures degrade gracefully.
- **Pay per event** - tiny flat start fee plus a per-program fee. A full-directory run costs ~$0.40; filtered runs cost cents.
- **No free-plan cap** - free-plan users get the same full directory as everyone else.

### Related Actors by the same developer

Hunting across platforms? These use the same schema philosophy (honest nulls, payout-focused scoring):

- [Immunefi Bug Bounty & Audit Competition Scraper](https://apify.com/tactful_anvil/immunefi-bug-bounty-audit-competition-scraper) - 240+ Immunefi programs with KYC/fee/PoC friction scores
- [Web3 Audit Contest Aggregator](https://apify.com/tactful_anvil/web3-audit-contest-aggregator) - Code4rena, Sherlock, CodeHawks and Cantina contests in one run
- [Superteam Earn Scraper](https://apify.com/tactful_anvil/superteam-earn-scraper) - Solana bounties with EV per entry

### FAQ

**Is this legal?** The Actor only reads the public program directory - the same data anyone sees in a browser without logging in. No login, no private data, no bypassing access controls.

**Why is `totalPaidUsd` null on some programs?** The program chose to keep its payout total private. We report `null` and set `paidIsPrivate: true` instead of guessing - and `payoutProven` is `null` for those, never `false`.

**How fresh is the data?** Each run fetches the live directory at that moment. See the scheduling section for a hands-off setup.

**A field came back null?** Some programs genuinely omit fields. Original display strings are always preserved under `raw`.

**Found a bug, or want another field?** Open a ticket on the **Issues** tab.

### Changelog

- **0.1** - Initial release: full bounty + audit program directory, payout proof (`totalPaidUsd`, `paidPerReportUsd`, `payoutProven`), competition buckets, opportunity score, HTTP-only, pay-per-event.

### Was this Actor useful?

If it saved you from spending a weekend on a program that never pays, a short review on the Store page helps other researchers decide whether to try it. Reviews are the only signal buyers have before they spend anything.

If something is wrong instead, please open a ticket on the **Issues** tab - field requests and parser bugs get fixed.

# Actor input Schema

## `programType` (type: `string`):

Which HackenProof boards to scrape.

## `status` (type: `string`):

'live' returns only programs currently accepting reports (default). 'all' includes paused and ended programs too.

## `minMaxBountyUsd` (type: `integer`):

Only programs whose published maximum bounty is at least this much.

## `onlyProvenPayout` (type: `boolean`):

Only programs that have publicly paid out more than $0 to researchers. Programs with a private payout total are excluded too (we cannot prove them).

## `maxSubmittedReports` (type: `integer`):

Cap the competition: only programs with at most this many submitted reports.

## `maxDaysSinceUpdate` (type: `integer`):

Only programs updated within the last N days.

## `triagedOnly` (type: `boolean`):

Only programs where HackenProof triages reports (usually faster, cleaner process).

## `projectTypes` (type: `array`):

e.g. DEX, CEX, Bridge, Lending, L1/L2, Wallet, Staking, DeFi, Stablecoin, Web2. Empty = all.

## `languages` (type: `array`):

e.g. Solidity, Rust, Move, Go, C++, TypeScript. Empty = all.

## `platforms` (type: `array`):

e.g. Solana, SUI, Near, Cosmos, Aptos. Empty = all.

## `searchText` (type: `string`):

Case-insensitive substring match on program name + description.

## `minOpportunityScore` (type: `integer`):

0-100. One number instead of five filters.

## `sortBy` (type: `string`):

Order of results.

## `maxItems` (type: `integer`):

Hard cap on returned results. You are only charged for returned results.

## `proxyConfiguration` (type: `object`):

Default: first request goes direct, and any retry automatically rotates through fresh Apify datacenter proxy sessions (hackenproof.com blocks some datacenter IPs). Only set a proxy here if you want to force every request through it.

## Actor input object example

```json
{
  "programType": "both",
  "status": "live",
  "onlyProvenPayout": false,
  "triagedOnly": false,
  "projectTypes": [],
  "languages": [],
  "platforms": [],
  "sortBy": "opportunity",
  "maxItems": 1000,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `programs` (type: `string`):

Every program returned by the run, one row each. Sorted by the sortBy input (default: opportunity score).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "proxyConfiguration": {
        "useApifyProxy": false
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("tactful_anvil/hackenproof-bug-bounty-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "proxyConfiguration": { "useApifyProxy": False } }

# Run the Actor and wait for it to finish
run = client.actor("tactful_anvil/hackenproof-bug-bounty-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}' |
apify call tactful_anvil/hackenproof-bug-bounty-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tactful_anvil/hackenproof-bug-bounty-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/TbWgYSaoZiteBQr74/builds/XQeuLLfyx5hj24ebr/openapi.json