Immunefi Bug Bounty & Audit Competition Scraper

Get every Immunefi bug bounty program and audit competition as clean structured data in one run - 240+ programs with max bounty, rewards pool, on-chain vault balance, accepted languages and ecosystems, and the last time anyone touched the program.

Then the part the website will not tell you: how much hassle stands between you and the money, and which of those 240 programs is actually worth your weekend.

No login, no API key, no cookies. HTTP-only, so runs finish in seconds.

Who is this for?

• Security researchers & whitehats - stop opening 40 tabs. Filter to programs that do not require KYC, do not charge a submission fee, accept the language you actually audit, and have not been abandoned by their triage team.
• Audit competition hunters - see every live competition, its prize pool, and exactly how many days are left before submissions close.
• Security firms & DAOs - benchmark your own program max bounty and terms against 240 live programs.
• Analysts & builders - the web3 bounty market as a dataset: track new program launches, bounty inflation, vault funding and ecosystem coverage over time.
• AI agents (MCP) - pay-per-event Actors are callable as tools. "Find Solana Rust programs paying $500k+ with no KYC" becomes a single tool call.

What makes this Actor different

The Immunefi board sorts by vault TVL. That is not the question a researcher has. A $15M max bounty behind mandatory KYC, a runnable-PoC requirement and a 100 USDC pay-to-submit fee is, for most hunters, a worse deal than a $250k program with none of that. This Actor quantifies both sides.

frictionScore (0-100, lower is better) - what it costs you to participate:

Weight	Barrier	Why it matters
35%	KYC required	Excludes pseudonymous researchers entirely - the single biggest filter
25%	Pay-to-submit fee	You pay (typically 50-100 USDC) just to file a report; scaled by fee size
25%	Proof-of-concept	runnable is dramatically more work than not_required
15%	Invite only	You cannot join at all without an invitation

Only known fields count toward the score - a program that publishes nothing scores null, not a flattering zero.

opportunityScore (0-100, higher is better) - is it worth your weekend:

• 45% bounty size - max bounty or competition rewards pool, log-scaled (bounties span four orders of magnitude, so a linear scale would make everything below $1M look identical)
• 25% low friction - the inverse of frictionScore
• 15% program upkeep - full marks if updated in the last 30 days, decaying to zero at a year. A program nobody has touched in 18 months may have a stale scope and an absent triage team.
• 15% payout assurance - a funded on-chain vault, Safe Harbor adoption and Immunefi Standard terms all mean the money is actually reachable

Output (one item per program)

Field	Example	Notes
project	LayerZero
board	bug-bounty	or audit-competition
opportunityScore	88.8	0-100, sortable
frictionScore	15	0-100, lower is better
maxBountyUsd	15000000	top payout for a critical finding
rewardsPoolUsd	1000000	competitions only
vaultBalanceUsd	310400	escrowed on-chain funds you can verify
kycRequired	false
proofOfConceptType	required	not_required / required / runnable
payToSubmit, payToSubmitFeeUsdc	true, 50	fee to file a report
inviteOnly, arbitration, immunefiStandard, safeHarborActive, premiumTriaging	booleans	program terms
competitionStatus, isLive, daysUntilEnd	LIVE, true, 10	competition lifecycle
daysSinceUpdate	20.6	staleness - the best abandonment signal on the board
ageDays, launchDate, updatedDate, endDate		timeline
languages	["Solidity"]	what you need to be able to read
ecosystems	["ETH","Base","Arbitrum"]	chains in scope
productTypes, programTypes, projectTypes, generalTags, features	arrays	Immunefi own tags
url	https://immunefi.com/bug-bounty/layerzero/information/	jump straight to scope

Fields Immunefi does not publish for a program come back null - never a fabricated zero.

Input highlights

• board - both (default), bounties, or competitions
• excludeKyc - hide programs requiring identity verification
• excludePayToSubmit - hide programs that charge you to report
• excludeInviteOnly - on by default; invite-only programs are not actionable
• liveCompetitionsOnly - drop finished and under-evaluation competitions
• minMaxBountyUsd, maxFrictionScore, minOpportunityScore, maxDaysSinceUpdate
• ecosystems, languages, projectTypes, searchText - slice the board
• sortBy - opportunity (default), maxBounty, lowestFriction, recentlyUpdated, newest, endingSoon, vaultBalance
• maxItems - you are only charged for returned results

Example: the pseudonymous Solidity hunter query

{
  "board": "bounties",
  "excludeKyc": true,
  "excludePayToSubmit": true,
  "languages": ["Solidity"],
  "minMaxBountyUsd": 250000,
  "maxDaysSinceUpdate": 120,
  "sortBy": "opportunity",
  "maxItems": 25
}

Solidity programs paying $250k+, no identity verification, no submission fee, actively maintained - ranked best first.

Example: catch every audit competition before it closes

{
  "board": "competitions",
  "liveCompetitionsOnly": true,
  "sortBy": "endingSoon",
  "maxItems": 50
}

How to schedule this Actor (recommended setup)

New programs launch, bounties get raised, vaults get funded and competitions close on a deadline. A scheduled run is how you find out on day one instead of week three.

1. Run the Actor once with the input you want and check the results.
2. On the Actor page open the ... menu and choose Schedule Actor (or go to Schedules and click Create new).
3. Set the cron expression:
   • 0 8 * * * - every morning. Immunefi refreshes its metrics daily, so this is the natural cadence for the bounty board.
   • 0 */6 * * * - every 6 hours. Use this for audit competitions, where a closing deadline matters.
   • 0 8 * * 1 - every Monday. Enough if you are tracking the market rather than hunting.
4. Attach the saved input. A tight input (maxItems: 25, sortBy: "opportunity") keeps each scheduled run to a few cents.
5. Add an integration so results come to you: Integrations, then Slack / Discord webhook / Google Sheets / Zapier / Make, triggered on Run succeeded.

Catching new programs: schedule with sortBy: "newest" and maxItems: 20. Anything that appears at the top of tomorrow dataset and was not in today is a program that just launched - usually before the crowd arrives.

Never miss a competition deadline: schedule board: "competitions", liveCompetitionsOnly: true, sortBy: "endingSoon" every 6 hours and route it to Slack. daysUntilEnd tells you exactly how long you have.

Why this Actor

• HTTP-only, no browser - seconds per run, and no residential proxy needed.
• Both boards in one run - bug bounties and audit competitions, deduplicated.
• Defensive parser - tolerates site structure drift; a malformed row is skipped, not crashed on.
• Pay per event - tiny flat start fee plus a per-program fee. A full run over all 240+ programs costs about $0.30; a filtered run costs cents.
• No free-plan cap - free-plan users get the same full board as everyone else.

FAQ

Is this legal? The Actor reads only the public program directory - the same pages anyone sees without logging in. No login, no private data, no bypassing access controls. Vulnerability reports and program-private metrics are not touched. Review the Immunefi terms for your specific use case.

How fresh is the data? Each run fetches the live boards at that moment. Immunefi states its own metrics are updated daily.

Why is total-paid missing? Most programs disable that metric - Immunefi shows "Private". We report what is actually published rather than guessing.

What does vaultBalanceUsd: null mean? The program has no Immunefi vault, which is different from a vault holding 0. We keep that distinction.

Found a bug, or want another field? Open a ticket on the Issues tab.

Changelog

• 0.1.1 - Two output views in the Console/Store Output tab: Overview and Friction check (KYC, pay-to-submit fee, PoC requirement and invite-only gate next to the money on the table). Full Actor output schema added, so AI agents and the API can discover the result shape automatically. No price change.
• 0.1 - Initial release: both Immunefi boards, friction and opportunity scoring, HTTP-only, pay-per-event.

Was this Actor useful?

If it saved you an evening of tab-hopping between program pages, a short review on the Store page helps other researchers decide whether to try it. Reviews are the only signal buyers have before they spend anything.

If something is wrong instead, please open a ticket on the Issues tab rather than leaving it broken - field requests and parser bugs get fixed.