Public Bug Bounty Pages & Program Export Cleaner

Clean, validate and deduplicate your bug bounty and vulnerability disclosure program exports into an Apify dataset. Provide JSON records or an Apify dataset ID. This workflow processes evidence you already have and labels its provenance clearly.

Quick start

1. Replace the demonstration JSON with your records.
2. Set maxItems to a small processing limit.
3. Start the Actor and open the default dataset.

For a dataset, clear providedRecords to [] and enter providedDatasetId instead. Use one source at a time. Only records you are authorized to process should be supplied.

{
  "providedRecords": [
    {
      "programName": "Owned demonstration program",
      "platform": "customer_supplied",
      "programType": "vdp",
      "sourceUrl": "https://example.com/owned-program/1",
      "programUrl": "https://example.com/owned-program/1",
      "isPublic": true,
      "requiresLogin": false,
      "opportunityScore": 0,
      "changeStatus": "unchanged",
      "scrapedAt": "2026-10-01T00:00:00Z",
      "contentHash": "62d9ac69cafae08feb1505a584a809cf878575f222e1ad19ece0241dad1c478e"
    }
  ],
  "maxItems": 1
}

What you receive

One row per accepted record, using the established output fields. Text is cleaned, records are checked against the output field types, and duplicates are excluded. Missing values are not filled with invented counters, dates or native website identifiers. An observed zero stays zero.

Rows include dataInputSource="provided", sourceVerified=false, sourceRecordHash and dataProcessedAt. The hash identifies processed content; it is not a website ID. Processing does not verify the original source, ownership claims, freshness or factual accuracy.

PROVIDED_DATA_SUMMARY in the run key-value store reports accepted, rejected, duplicate and confirmed delivered counts. Dataset read limits and incomplete scans are disclosed. Diagnostics are not paid dataset rows.

Collection availability

Supported public HTML collection remains available. API-backed sources are unavailable. Existing input fields remain accepted for integrations, but they do not trigger a source API or another Actor. Without supplied data, existing page-based input fields select live HTML collection. Unsupported API-only sources report source failures and deliver no replacement result rows. Public HackerOne HTML collection remains supported. Intigriti, YesWeHack, Bugcrowd JSON and Disclose structured-data routes are disabled. Supplied opportunity scores and public-scope claims are not independently verified; they do not authorize security testing.

Pricing and limits

Check the Actor Pricing tab for current charges. Each delivered primary record uses the existing result event. Start fees and platform usage may still apply to empty or failed runs. Start with one record; the input limit bounds records scanned, including rejected records and duplicates.

Python API example

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("thescrapelab/bug-bounty-program-finder").call(run_input={
    "providedDatasetId": "YOUR_DATASET_ID",
    "maxItems": 1,
})
if run is None:
    raise RuntimeError("Actor did not return run metadata")
dataset_id = run["defaultDatasetId"] if isinstance(run, dict) else run.default_dataset_id
for record in client.dataset(dataset_id).iterate_items():
    print(record)

Troubleshooting

• No valid rows: inspect rejection codes and check the documented fields and types.
• Only part of a dataset read: increase the processing limit and review sourceDatasetLimited in the summary.
• Inaccessible dataset: use a 17-character ID and an Apify token with read access.
• Unsupported live mode: supply your existing records; adding source credentials does not enable collection.

Open the Issues tab with a run ID and a sanitized example for support.

The supplied demonstration is authored example data, not a website observation. Replace all identifiers, source labels, timestamps, scores and monitoring flags with your own complete export. These values remain customer assertions and are not independently verified.

Output example

Illustrative output; replace source values with your own authorized evidence.

{
  "programName": "Owned demonstration program",
  "platform": "customer_supplied",
  "programType": "vdp",
  "sourceUrl": "https://example.com/owned-program/1",
  "programUrl": "https://example.com/owned-program/1",
  "isPublic": true,
  "requiresLogin": false,
  "opportunityScore": 0,
  "changeStatus": "unchanged",
  "scrapedAt": "2026-10-01T00:00:00Z",
  "contentHash": "62d9ac69cafae08feb1505a584a809cf878575f222e1ad19ece0241dad1c478e",
  "dataInputSource": "provided",
  "sourceVerified": false
}