Immunefi Bug Bounty Scraper | Audit Contests & Friction Score

Get every Immunefi bug bounty program and audit competition as clean structured data in one run — 240+ programs with max bounty, rewards pool, on-chain vault balance, accepted languages and ecosystems, and the last time anyone touched the program. HTTP-only, pay per result ($0.95 / 1,000 programs + $0.01 per run — the full board is ≈ $0.23), MCP-ready.

Then the part the website won't tell you: how much hassle stands between you and the money, and which of those 240 programs is actually worth your weekend.

No login, no API key, no cookies. HTTP-only, so runs finish in seconds.

Who is this for?

• Security researchers & whitehats — stop opening 40 tabs. Filter to programs that don't require KYC, don't charge a submission fee, accept the language you actually audit, and haven't been abandoned by their triage team.
• Audit competition hunters — see every live competition, its prize pool, and exactly how many days are left before submissions close.
• Security firms & DAOs — benchmark your own program's max bounty and terms against 240 live programs.
• Analysts & builders — the web3 bounty market as a dataset: track new program launches, bounty inflation, vault funding and ecosystem coverage over time.
• AI agents (MCP) — pay-per-event Actors are callable as tools. "Find Solana Rust programs paying $500k+ with no KYC" becomes a single tool call.

What makes this Actor different

Immunefi's own board sorts by vault TVL. That is not the question a researcher has. A $15M max bounty behind mandatory KYC, a runnable-PoC requirement and a $100 pay-to-submit fee is, for most hunters, a worse deal than a $250k program with none of that. This Actor quantifies both sides.

frictionScore (0-100, lower is better) — what it costs you to participate:

Weight	Barrier	Why it matters
35%	KYC required	Excludes pseudonymous researchers entirely — the single biggest filter
25%	Pay-to-submit fee	You pay (typically $50–100 USDC) just to file a report; scaled by fee size
25%	Proof-of-concept	runnable is dramatically more work than not_required
15%	Invite only	You can't join at all without an invitation

Only known fields count toward the score — a program that publishes nothing scores null, not a flattering zero.

opportunityScore (0-100, higher is better) — is it worth your weekend:

• 45% bounty size — max bounty or competition rewards pool, log-scaled (bounties span four orders of magnitude, so a linear scale would make everything below $1M look identical)
• 25% low friction — the inverse of frictionScore
• 15% program upkeep — full marks if updated in the last 30 days, decaying to zero at a year. A program nobody has touched in 18 months may have a stale scope and an absent triage team.
• 15% payout assurance — a funded on-chain vault, Safe Harbor adoption and Immunefi Standard terms all mean the money is actually reachable

Output (one item per program)

Field	Example	Notes
project	LayerZero
board	bug-bounty	or audit-competition
opportunityScore	88.8	0-100, sortable
frictionScore	15	0-100, lower is better
maxBountyUsd	15000000	top payout for a critical finding
rewardsPoolUsd	1000000	competitions only
vaultBalanceUsd	310400	escrowed on-chain funds you can verify
kycRequired	false
proofOfConceptType	required	not_required / required / runnable
payToSubmit, payToSubmitFeeUsdc	true, 50	fee to file a report
inviteOnly, arbitration, immunefiStandard, safeHarborActive, premiumTriaging	booleans	program terms
competitionStatus, isLive, daysUntilEnd	LIVE, true, 10	competition lifecycle
daysSinceUpdate	20.6	staleness — the best abandonment signal on the board
ageDays, launchDate, updatedDate, endDate		timeline
languages	["Solidity"]	what you need to be able to read
ecosystems	["ETH","Base","Arbitrum"]	chains in scope
productTypes, programTypes, projectTypes, generalTags, features	arrays	Immunefi's own tags
url	https://immunefi.com/bug-bounty/layerzero/information/	jump straight to scope

Fields Immunefi doesn't publish for a program come back null — never a fabricated zero.

Input highlights

• board — both (default), bounties, or competitions
• excludeKyc — hide programs requiring identity verification
• excludePayToSubmit — hide programs that charge you to report
• excludeInviteOnly — on by default; invite-only programs aren't actionable
• liveCompetitionsOnly — drop finished and under-evaluation competitions
• minMaxBountyUsd, maxFrictionScore, minOpportunityScore, maxDaysSinceUpdate
• ecosystems, languages, projectTypes, searchText — slice the board
• sortBy — opportunity (default), maxBounty, lowestFriction, recentlyUpdated, newest, endingSoon, vaultBalance
• maxItems — you are only charged for returned results

Example: the pseudonymous Solidity hunter's query

{
  "board": "bounties",
  "excludeKyc": true,
  "excludePayToSubmit": true,
  "languages": ["Solidity"],
  "minMaxBountyUsd": 250000,
  "maxDaysSinceUpdate": 120,
  "sortBy": "opportunity",
  "maxItems": 25
}

Solidity programs paying $250k+, no identity verification, no submission fee, actively maintained — ranked best first.

Example: catch every audit competition before it closes

{
  "board": "competitions",
  "liveCompetitionsOnly": true,
  "sortBy": "endingSoon",
  "maxItems": 50
}

Example output (one real row, 7 Sep 2026)

Default input (board: "both", excludeInviteOnly: true) returned 234 programs (182 bug bounties + 62 audit competitions) in ~4 s. Top row by opportunityScore, untouched (logo/description trimmed):

{
  "id": "4MSwmyXBE9T6RRVOHPX6fj",
  "slug": "sky",
  "project": "Sky",
  "board": "bug-bounty",
  "url": "https://immunefi.com/bug-bounty/sky/information/",
  "maxBountyUsd": 10000000,
  "rewardsPoolUsd": null,
  "vaultBalanceUsd": null,
  "kycRequired": false,
  "proofOfConceptType": "required",
  "payToSubmit": true,
  "payToSubmitFeeUsdc": 50,
  "inviteOnly": false,
  "arbitration": false,
  "immunefiStandard": true,
  "premiumTriaging": true,
  "safeHarborActive": false,
  "competitionStatus": null,
  "launchDate": "2022-02-10T07:00:00.000Z",
  "updatedDate": "2026-09-04T14:22:36.740Z",
  "endDate": null,
  "languages": ["Solidity"],
  "ecosystems": ["ETH"],
  "productTypes": ["CDP", "Lending", "Staking"],
  "programTypes": ["Smart Contract", "Websites and Applications"],
  "projectTypes": ["Defi"],
  "generalTags": ["Triaged by Immunefi", "Immunefi Standard", "KYC Not Required", "Paid Submissions", "PoC Required"],
  "ageDays": 1669.5,
  "daysSinceUpdate": 2.2,
  "daysUntilEnd": null,
  "isLive": true,
  "frictionScore": 27.5,
  "opportunityScore": 85.6
}

Cost of that run: 234 × $0.00095 + $0.01 ≈ $0.23.

How to schedule this Actor (recommended setup)

New programs launch, bounties get raised, vaults get funded and competitions close on a deadline. A scheduled run is how you find out on day one instead of week three.

1. Run the Actor once with the input you want and check the results.
2. On the Actor page click ⋯ → Schedule Actor (or go to Schedules → Create new).
3. Set the cron expression:
   • 0 8 * * * — every morning. Immunefi refreshes its metrics daily, so this is the natural cadence for the bounty board.
   • 0 */6 * * * — every 6 hours. Use this for audit competitions, where a closing deadline matters.
   • 0 8 * * 1 — every Monday. Enough if you're tracking the market rather than hunting.
4. Attach the saved input. A tight input (maxItems: 25, sortBy: "opportunity") keeps each scheduled run to a few cents.
5. Add an integration so results come to you: Integrations → Slack / Discord webhook / Google Sheets / Zapier / Make, triggered on Run succeeded.

Catching new programs: schedule with sortBy: "newest" and maxItems: 20. Anything that appears at the top of tomorrow's dataset and wasn't in today's is a program that just launched — usually before the crowd arrives.

Never miss a competition deadline: schedule board: "competitions", liveCompetitionsOnly: true, sortBy: "endingSoon" every 6 hours and route it to Slack. daysUntilEnd tells you exactly how long you have.

Why this Actor

• HTTP-only, no browser → seconds per run, and no residential proxy needed.
• Both boards in one run → bug bounties and audit competitions, deduplicated.
• Defensive parser → tolerates site structure drift; a malformed row is skipped, not crashed on.
• Pay per event → tiny flat start fee plus a per-program fee. A full run over all 240+ programs costs about $0.30; a filtered run costs cents.
• No free-plan cap — free-plan users get the same full board as everyone else.

FAQ

Is this legal? The Actor reads only the public program directory — the same pages anyone sees without logging in. No login, no private data, no bypassing access controls. Vulnerability reports and program-private metrics are not touched. Review Immunefi's terms for your specific use case.

How fresh is the data? Each run fetches the live boards at that moment. Immunefi states its own metrics are updated daily.

Why is totalPaid missing? Most programs disable that metric — Immunefi shows "Private". We report what is actually published rather than guessing.

What does vaultBalanceUsd: null mean? The program has no Immunefi vault, which is different from a vault holding $0. We keep that distinction.

Found a bug, or want another field? Open a ticket on the Issues tab.

Related Actors (same developer) — the bug-bounty trio

• HackenProof Bug Bounty Scraper | Payout Proof & Competition — the other big Web3 bounty board, with paid-out proof per program.
• Web3 Audit Contest Aggregator | C4, Sherlock, Cantina & More — live and upcoming audit contests across Code4rena, Sherlock, Cantina, CodeHawks in one feed.
• Superteam Earn Scraper | Bounties, Projects & EV per Entry — Solana bounties and projects with expected value per entry.

Changelog

• 0.1.2 (24 Sep 2026) — Reliability: If immunefi.com is briefly unreachable the run now waits and retries instead of failing, one malformed program is skipped instead of stopping the run, and an unavailable proxy group falls back to a direct connection. No price or field change.
• 0.1.1 (19 Sep 2026) — Typo guard on input. Apify accepts input fields an Actor does not know without complaining, so a misspelled option used to produce a successful run with that setting silently inactive. The run log now warns for every unknown field and suggests the closest real one.
• 2026-09-07 — README: real example row, cost math, related Actors. Fetch timeouts + default run limits (512 MB) so a slow upstream can never hang for an hour.
• 0.1 — Initial release: both Immunefi boards, friction and opportunity scoring, HTTP-only, pay-per-event.

Found this useful? Bookmark & review

If it saved you an evening of tab-hopping between program pages, a short ⭐ review on the Store page helps other researchers decide whether to try it — and a bookmark keeps it one click away. Reviews are the only signal buyers have before they spend anything.

If something is wrong instead, please open a ticket on the Issues tab rather than leaving it broken - field requests and parser bugs get fixed.