# Immunefi Bug Bounty & Audit Competition Scraper (`tactful_anvil/immunefi-bug-bounty-audit-competition-scraper`) Actor

Scrape every Immunefi bug bounty program and audit competition: max bounty, rewards pool, vault balance, KYC / proof-of-concept / pay-to-submit friction, ecosystems and languages. Friction and opportunity scores rank 240+ programs by what is worth hunting. HTTP-only, no login.

- **URL**: https://apify.com/tactful\_anvil/immunefi-bug-bounty-audit-competition-scraper.md
- **Developed by:** [Mr Zack](https://apify.com/tactful_anvil) (community)
- **Categories:** Developer tools, Automation, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.20 / 1,000 program results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Immunefi Bug Bounty & Audit Competition Scraper

Get **every Immunefi bug bounty program and audit competition** as clean structured data in one run - 240+ programs with max bounty, rewards pool, on-chain vault balance, accepted languages and ecosystems, and the last time anyone touched the program.

Then the part the website will not tell you: **how much hassle stands between you and the money**, and **which of those 240 programs is actually worth your weekend**.

No login, no API key, no cookies. HTTP-only, so runs finish in seconds.

### Who is this for?

- **Security researchers & whitehats** - stop opening 40 tabs. Filter to programs that do not require KYC, do not charge a submission fee, accept the language you actually audit, and have not been abandoned by their triage team.
- **Audit competition hunters** - see every live competition, its prize pool, and exactly how many days are left before submissions close.
- **Security firms & DAOs** - benchmark your own program max bounty and terms against 240 live programs.
- **Analysts & builders** - the web3 bounty market as a dataset: track new program launches, bounty inflation, vault funding and ecosystem coverage over time.
- **AI agents (MCP)** - pay-per-event Actors are callable as tools. *"Find Solana Rust programs paying $500k+ with no KYC"* becomes a single tool call.

### What makes this Actor different

The Immunefi board sorts by vault TVL. That is not the question a researcher has. A $15M max bounty behind mandatory KYC, a runnable-PoC requirement and a 100 USDC pay-to-submit fee is, for most hunters, a worse deal than a $250k program with none of that. This Actor quantifies both sides.

**`frictionScore` (0-100, lower is better)** - what it costs you to participate:

| Weight | Barrier | Why it matters |
| --- | --- | --- |
| 35% | KYC required | Excludes pseudonymous researchers entirely - the single biggest filter |
| 25% | Pay-to-submit fee | You pay (typically 50-100 USDC) just to file a report; scaled by fee size |
| 25% | Proof-of-concept | `runnable` is dramatically more work than `not_required` |
| 15% | Invite only | You cannot join at all without an invitation |

Only known fields count toward the score - a program that publishes nothing scores `null`, not a flattering zero.

**`opportunityScore` (0-100, higher is better)** - is it worth your weekend:

- **45% bounty size** - max bounty or competition rewards pool, log-scaled (bounties span four orders of magnitude, so a linear scale would make everything below $1M look identical)
- **25% low friction** - the inverse of `frictionScore`
- **15% program upkeep** - full marks if updated in the last 30 days, decaying to zero at a year. A program nobody has touched in 18 months may have a stale scope and an absent triage team.
- **15% payout assurance** - a funded on-chain vault, Safe Harbor adoption and Immunefi Standard terms all mean the money is actually reachable

### Output (one item per program)

| Field | Example | Notes |
| --- | --- | --- |
| `project` | `LayerZero` | |
| `board` | `bug-bounty` | or `audit-competition` |
| `opportunityScore` | `88.8` | 0-100, sortable |
| `frictionScore` | `15` | 0-100, lower is better |
| `maxBountyUsd` | `15000000` | top payout for a critical finding |
| `rewardsPoolUsd` | `1000000` | competitions only |
| `vaultBalanceUsd` | `310400` | escrowed on-chain funds you can verify |
| `kycRequired` | `false` | |
| `proofOfConceptType` | `required` | `not_required` / `required` / `runnable` |
| `payToSubmit`, `payToSubmitFeeUsdc` | `true`, `50` | fee to file a report |
| `inviteOnly`, `arbitration`, `immunefiStandard`, `safeHarborActive`, `premiumTriaging` | booleans | program terms |
| `competitionStatus`, `isLive`, `daysUntilEnd` | `LIVE`, `true`, `10` | competition lifecycle |
| `daysSinceUpdate` | `20.6` | staleness - the best abandonment signal on the board |
| `ageDays`, `launchDate`, `updatedDate`, `endDate` | | timeline |
| `languages` | `["Solidity"]` | what you need to be able to read |
| `ecosystems` | `["ETH","Base","Arbitrum"]` | chains in scope |
| `productTypes`, `programTypes`, `projectTypes`, `generalTags`, `features` | arrays | Immunefi own tags |
| `url` | `https://immunefi.com/bug-bounty/layerzero/information/` | jump straight to scope |

Fields Immunefi does not publish for a program come back `null` - never a fabricated zero.

### Input highlights

- `board` - `both` (default), `bounties`, or `competitions`
- `excludeKyc` - hide programs requiring identity verification
- `excludePayToSubmit` - hide programs that charge you to report
- `excludeInviteOnly` - on by default; invite-only programs are not actionable
- `liveCompetitionsOnly` - drop finished and under-evaluation competitions
- `minMaxBountyUsd`, `maxFrictionScore`, `minOpportunityScore`, `maxDaysSinceUpdate`
- `ecosystems`, `languages`, `projectTypes`, `searchText` - slice the board
- `sortBy` - `opportunity` (default), `maxBounty`, `lowestFriction`, `recentlyUpdated`, `newest`, `endingSoon`, `vaultBalance`
- `maxItems` - you are only charged for returned results

#### Example: the pseudonymous Solidity hunter query

```json
{
  "board": "bounties",
  "excludeKyc": true,
  "excludePayToSubmit": true,
  "languages": ["Solidity"],
  "minMaxBountyUsd": 250000,
  "maxDaysSinceUpdate": 120,
  "sortBy": "opportunity",
  "maxItems": 25
}
```

Solidity programs paying $250k+, no identity verification, no submission fee, actively maintained - ranked best first.

#### Example: catch every audit competition before it closes

```json
{
  "board": "competitions",
  "liveCompetitionsOnly": true,
  "sortBy": "endingSoon",
  "maxItems": 50
}
```

### How to schedule this Actor (recommended setup)

New programs launch, bounties get raised, vaults get funded and competitions close on a deadline. A scheduled run is how you find out on day one instead of week three.

1. Run the Actor once with the input you want and check the results.
2. On the Actor page open the **...** menu and choose **Schedule Actor** (or go to [Schedules](https://console.apify.com/schedules) and click **Create new**).
3. Set the cron expression:
   - `0 8 * * *` - every morning. Immunefi refreshes its metrics daily, so this is the natural cadence for the bounty board.
   - `0 */6 * * *` - every 6 hours. Use this for audit competitions, where a closing deadline matters.
   - `0 8 * * 1` - every Monday. Enough if you are tracking the market rather than hunting.
4. Attach the saved input. A tight input (`maxItems: 25`, `sortBy: "opportunity"`) keeps each scheduled run to a few cents.
5. Add an integration so results come to you: **Integrations**, then **Slack / Discord webhook / Google Sheets / Zapier / Make**, triggered on *Run succeeded*.

**Catching new programs:** schedule with `sortBy: "newest"` and `maxItems: 20`. Anything that appears at the top of tomorrow dataset and was not in today is a program that just launched - usually before the crowd arrives.

**Never miss a competition deadline:** schedule `board: "competitions"`, `liveCompetitionsOnly: true`, `sortBy: "endingSoon"` every 6 hours and route it to Slack. `daysUntilEnd` tells you exactly how long you have.

### Why this Actor

- **HTTP-only, no browser** - seconds per run, and no residential proxy needed.
- **Both boards in one run** - bug bounties and audit competitions, deduplicated.
- **Defensive parser** - tolerates site structure drift; a malformed row is skipped, not crashed on.
- **Pay per event** - tiny flat start fee plus a per-program fee. A full run over all 240+ programs costs about $0.30; a filtered run costs cents.
- **No free-plan cap** - free-plan users get the same full board as everyone else.

### FAQ

**Is this legal?** The Actor reads only the public program directory - the same pages anyone sees without logging in. No login, no private data, no bypassing access controls. Vulnerability reports and program-private metrics are not touched. Review the Immunefi terms for your specific use case.

**How fresh is the data?** Each run fetches the live boards at that moment. Immunefi states its own metrics are updated daily.

**Why is total-paid missing?** Most programs disable that metric - Immunefi shows "Private". We report what is actually published rather than guessing.

**What does `vaultBalanceUsd: null` mean?** The program has no Immunefi vault, which is different from a vault holding 0. We keep that distinction.

**Found a bug, or want another field?** Open a ticket on the **Issues** tab.

### Changelog

- **0.1.1** - Two output views in the Console/Store **Output** tab: *Overview* and *Friction check* (KYC, pay-to-submit fee, PoC requirement and invite-only gate next to the money on the table). Full Actor output schema added, so AI agents and the API can discover the result shape automatically. **No price change.**
- **0.1** - Initial release: both Immunefi boards, friction and opportunity scoring, HTTP-only, pay-per-event.

### Was this Actor useful?

If it saved you an evening of tab-hopping between program pages, a short review on the Store page helps other researchers decide whether to try it. Reviews are the only signal buyers have before they spend anything.

If something is wrong instead, please open a ticket on the **Issues** tab rather than leaving it broken - field requests and parser bugs get fixed.

# Actor input Schema

## `board` (type: `string`):

<b>both</b> = bug bounty programs + audit competitions (default). <b>bounties</b> = always-open bug bounty programs only. <b>competitions</b> = time-boxed audit competitions only.

## `excludeKyc` (type: `boolean`):

Hide programs that require identity verification before paying out. Essential if you research pseudonymously.

## `excludePayToSubmit` (type: `boolean`):

Hide programs that charge a fee (typically 50-100 USDC) just to file a report.

## `excludeInviteOnly` (type: `boolean`):

Hide programs you cannot join without an invitation. On by default - they are not actionable.

## `liveCompetitionsOnly` (type: `boolean`):

Drop finished and evaluating audit competitions, keeping only those still accepting submissions.

## `minMaxBountyUsd` (type: `integer`):

Only programs whose top payout is at least this much. Example: <code>100000</code>.

## `maxFrictionScore` (type: `integer`):

Friction combines KYC (35%), submission fee (25%), proof-of-concept requirement (25%) and invite-only (15%). Example: <code>25</code> returns only low-hassle programs.

## `minOpportunityScore` (type: `integer`):

Composite of bounty size (45%), low friction (25%), program upkeep (15%) and payout assurance (15%). Example: <code>60</code>.

## `maxDaysSinceUpdate` (type: `integer`):

Skip abandoned programs. Example: <code>90</code> keeps only programs whose scope has been touched in the last quarter.

## `ecosystems` (type: `array`):

Filter by chain/ecosystem tag, e.g. <code>ETH</code>, <code>Solana</code>, <code>Base</code>, <code>Arbitrum</code>. Leave empty for all. Case-insensitive.

## `languages` (type: `array`):

Filter by the code you can actually audit, e.g. <code>Solidity</code>, <code>Rust</code>, <code>Go</code>, <code>Move</code>. Leave empty for all.

## `projectTypes` (type: `array`):

Filter by project type tag, e.g. <code>Infrastructure</code>, <code>DeFi</code>. Leave empty for all.

## `searchText` (type: `string`):

Substring match against project name, slug, ecosystems, languages and project types (case-insensitive).

## `sortBy` (type: `string`):

Order of the dataset.

## `maxItems` (type: `integer`):

Upper limit of programs to return (you are only charged for returned results).

## `proxyConfiguration` (type: `object`):

Proxy settings. The default datacenter proxy works - the boards are public and HTTP-only. Switch to the RESIDENTIAL group only if runs start returning zero programs.

## Actor input object example

```json
{
  "board": "both",
  "excludeKyc": false,
  "excludePayToSubmit": false,
  "excludeInviteOnly": true,
  "liveCompetitionsOnly": false,
  "ecosystems": [],
  "languages": [],
  "projectTypes": [],
  "sortBy": "opportunity",
  "maxItems": 1000,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `programs` (type: `string`):

Every bug bounty program and audit competition returned by the run, one row each. Ordered by the sortBy input (default: opportunity score).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "proxyConfiguration": {
        "useApifyProxy": true
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("tactful_anvil/immunefi-bug-bounty-audit-competition-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "proxyConfiguration": { "useApifyProxy": True } }

# Run the Actor and wait for it to finish
run = client.actor("tactful_anvil/immunefi-bug-bounty-audit-competition-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}' |
apify call tactful_anvil/immunefi-bug-bounty-audit-competition-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tactful_anvil/immunefi-bug-bounty-audit-competition-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/P16exTNzGUUcdNEwE/builds/AN9EV5udm01lf1Nka/openapi.json