# Bug Bounty Program Finder (`thescrapelab/bug-bounty-program-finder`) Actor

Find public bug bounty programs, vulnerability disclosure programs, security.txt contacts, rewards, scope, safe harbor notes, and disclosure policy URLs, then output normalized security program records for research, lead generation, and monitoring.

- **URL**: https://apify.com/thescrapelab/bug-bounty-program-finder.md
- **Developed by:** [Inus Grobler](https://apify.com/thescrapelab) (community)
- **Categories:** Developer tools, Lead generation, Automation
- **Stats:** 3 total users, 1 monthly users, 98.1% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.25 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

<p align="center">
  <img src="./.actor/logo.png" alt="Bug Bounty Program Finder logo" width="260" />
</p>

Bug Bounty Program Finder is a bug bounty scraper, vulnerability disclosure program finder, and security.txt scraper for security researchers, AppSec teams, OSINT analysts, sales teams, and cybersecurity vendors.

Use it to discover public bug bounty programs, VDPs, responsible disclosure pages, security contact emails, reward ranges, safe harbor signals, and program URLs across HackerOne, Bugcrowd, Intigriti, YesWeHack, disclose.io, Open Bug Bounty, HackenProof, security.txt files, and public security policy pages.

### What You Can Do

- Find public bug bounty and VDP programs by keyword, company, industry, or domain.
- Check specific domains for security.txt files and public disclosure policy pages.
- Export normalized program records for CRM, research, attack surface management, or monitoring workflows.
- Filter by program type, bounty amount, safe harbor signals, and changed records.
- Optionally enrich in-scope domains with passive DNS lookups.

### Best For

- Security researchers looking for public bounty opportunities and responsible disclosure contacts.
- AppSec and vulnerability management teams building a list of disclosure programs for vendors, partners, or assets.
- OSINT analysts researching security policy pages, security.txt files, and public reporting channels.
- Cybersecurity sales and marketing teams building lead lists of companies with active security programs.
- Bug bounty platforms, consultancies, and managed security providers tracking program coverage.

### Supported Public Sources

The Actor searches public directories and public web pages. Supported sources include HackerOne, Bugcrowd, Intigriti, YesWeHack, disclose.io, Open Bug Bounty, HackenProof, Yandex bug bounty listings, security.txt files, and generic public security policy pages.

### What Data You Get

Output examples, dataset fields, limitations, troubleshooting, and pricing guidance are included below so you can evaluate the data before running larger exports.

Each dataset item can include:

- Program and company name
- Hosting platform or discovery source
- Program URL, policy URL, submission URL, and source URL
- Program type: bug bounty, VDP, security.txt, security policy, or unknown
- Minimum and maximum bounty when visible
- Currency and reward summary
- Safe harbor signal and safe harbor URL when detected
- Contact email or security.txt URL when available
- In-scope assets and optional DNS enrichment
- Tags, opportunity score, content hash, first seen date, last seen date, and change status

### Simple Input

Most users only need a keyword and a result limit:

```json
{
  "query": "fintech",
  "maxItems": 100
}
```

To check specific domains:

```json
{
  "domainOrUrl": "https://github.com/security",
  "maxItems": 50
}
```

`startDomains` and `startUrls` are still supported for older API integrations. New Console users can use the `Domains or URLs` dropdown.

Good starter keywords include `fintech`, `crypto`, `cloud`, `SaaS`, `API`, `mobile`, `healthcare`, `banking`, company names, and domain names.

### Automatic Defaults

The Actor keeps setup simple by default:

- It searches all supported public sources.
- It visits detail pages when useful for richer scope, reward, submission, and safe harbor data.
- It includes paid bug bounty programs, VDPs, security.txt records, and public security policy pages.
- It does not run optional DNS enrichment unless an existing integration explicitly enables it.
- It keeps older advanced input fields working for API users, but new users do not need to configure them.

### Output Examples

```json
{
  "programName": "Example Security Program",
  "companyName": "Example",
  "platform": "HackerOne",
  "programType": "bug_bounty",
  "programUrl": "https://hackerone.com/example",
  "policyUrl": "https://example.com/security",
  "submissionUrl": "https://hackerone.com/example/reports/new",
  "sourceUrl": "https://hackerone.com/example",
  "isPublic": true,
  "requiresLogin": false,
  "bountyMax": 5000,
  "currency": "USD",
  "rewardSummary": "Up to $5,000",
  "safeHarbor": true,
  "contactEmail": "security@example.com",
  "tags": ["public", "paid", "safe-harbor"],
  "opportunityScore": 70,
  "changeStatus": "new",
  "firstSeenAt": "2026-06-16T08:00:00.000Z",
  "lastSeenAt": "2026-06-16T08:00:00.000Z",
  "scrapedAt": "2026-06-16T08:00:00.000Z"
}
```

### Running On Apify

1. Open the Actor in Apify Console.
2. Enter a keyword, domains, or both.
3. Set `maxItems` to the number of records you need.
4. Start the run.

Results are streamed to the default Apify Dataset during the run, so partial results remain useful if a long run is stopped or times out.

### Exporting Results

Open the run dataset and export results as JSON, CSV, Excel, XML, RSS, or HTML from Apify Console. For automation, use the Apify API client:

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")

run = client.actor("thescrapelab/bug-bounty-program-finder").call(run_input={
    "query": "cloud",
    "maxItems": 100,
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["programName"], item.get("programUrl"))
```

### Limitations And Caveats

- The Actor only collects public programs and public policy pages. It does not access invite-only or private programs.
- Some sources may change page structure, block requests, or temporarily return fewer records.
- Detail extraction depends on what each program publicly displays.
- `safeHarbor` means safe harbor language was detected; always review the linked policy before testing.
- Very broad high-volume runs can take longer because the Actor politely checks multiple public sources.

### Troubleshooting

- No results: try a broader keyword or add one or more domains.
- Few domain results: not every domain publishes security.txt or a public disclosure policy.
- Missing rewards: many VDPs do not publish bounty amounts.
- Slow run: reduce `maxItems` or use a more specific keyword.
- Duplicate-looking records: the Actor deduplicates by normalized name and URL, but some companies operate separate programs on different platforms.

### Bug bounty finder pricing and cost control

The current Store price appears before each run. The Actor uses lightweight HTTP requests, so cost grows mainly with the number of public sources, detail pages, and program records checked. Keep `maxItems` low for a first search, enable detail or asset enrichment only when needed, and expand the run after reviewing the initial results.

### FAQ

#### Can I scrape HackerOne and Bugcrowd bug bounty programs?

Yes. Select `hackerone`, `bugcrowd`, or keep the default `all` source selection.

#### Can I find security.txt contacts?

Yes. Add domains or URLs with `startUrls`; the Actor checks security.txt and public policy pages automatically.

#### Can I find vulnerability disclosure programs for specific domains?

Yes. Add domains or URLs with `startUrls`; the Actor checks security.txt and generic public policy pages automatically.

#### Does this include private bug bounty programs?

No. It only collects public programs and public policy pages.

#### Can I monitor new or updated programs?

Yes. The Actor stores content hashes and marks records as `new`, `updated`, or `unchanged` across runs using the same default key-value store.

#### Is it safe to use results for vulnerability testing?

Use the output as a discovery aid only. Always read the linked program policy, scope, and safe harbor text before testing.

#### What keywords should I try?

Common searches include `fintech`, `crypto`, `cloud`, `SaaS`, `API`, `mobile`, company names, and domain names.

#### Can I export bug bounty leads to CSV or Excel?

Yes. Open the Apify Dataset after the run and export the results as CSV, Excel, JSON, XML, RSS, HTML, or through the Apify API.

# Actor input Schema

## `query` (type: `string`):

Optional search term for finding public bug bounty programs and vulnerability disclosure programs. Use a company name, domain, industry, or topic such as fintech, cloud, crypto, SaaS, or API.

## `domainOrUrl` (type: `string`):

Optional preset domain or security page to check directly. Leave blank to search by keyword only.

## `startUrls` (type: `array`):

Backward-compatible API field for custom domains or URLs to check directly for security.txt files, security pages, and public disclosure policy pages.

## `startDomains` (type: `array,string`):

Legacy field for direct domain checks. You can use this or the Domains or URLs field above.

## `sources` (type: `array`):

Choose where to search for bug bounty programs, VDPs, security.txt contacts, and policy pages. The default uses one reliable source for a fast first run; API users can select all for broad discovery.

## `maxItems` (type: `integer`):

Maximum number of program records to collect. Use a small limit for testing and a larger limit for full exports.

## `includeDetails` (type: `boolean`):

Visit individual program pages to extract richer scope, reward, submission, and safe harbor details. Turn off for cheaper directory-only runs.

## `programType` (type: `string`):

Optionally keep only one type of result.

## `minBounty` (type: `integer`):

Only include programs with a known maximum reward at or above this amount. Set 0 for no reward filter.

## `includeNoRewardPrograms` (type: `boolean`):

Include vulnerability disclosure programs and policy pages that do not publish a monetary reward.

## `safeHarborOnly` (type: `boolean`):

Only return programs where safe harbor language was detected.

## `enrichAssets` (type: `boolean`):

Passively resolve IPs, CNAMEs, and TXT records for in-scope domains. This can make runs slower and should only be enabled when you need DNS context.

## `changedSince` (type: `string`):

Optional ISO date. When combined with a previous run, only return programs first seen or updated since this date.

## Actor input object example

```json
{
  "query": "github",
  "domainOrUrl": "https://github.com/security",
  "startUrls": [
    {
      "url": "https://github.com/security"
    }
  ],
  "sources": [
    "bugcrowd"
  ],
  "maxItems": 10,
  "includeDetails": false,
  "programType": "all",
  "minBounty": 0,
  "includeNoRewardPrograms": true,
  "safeHarborOnly": false,
  "enrichAssets": false,
  "changedSince": "2026-01-01"
}
```

# Actor output Schema

## `programs` (type: `string`):

Structured public bug bounty, VDP, security.txt, and security policy records in the default Dataset.

## `runSummary` (type: `string`):

Run summary with result counts, source counts, duplicate count, and source-level errors.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "query": "github",
    "domainOrUrl": "https://github.com/security",
    "startUrls": [
        {
            "url": "https://github.com/security"
        }
    ],
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("thescrapelab/bug-bounty-program-finder").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "query": "github",
    "domainOrUrl": "https://github.com/security",
    "startUrls": [{ "url": "https://github.com/security" }],
    "maxItems": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("thescrapelab/bug-bounty-program-finder").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "query": "github",
  "domainOrUrl": "https://github.com/security",
  "startUrls": [
    {
      "url": "https://github.com/security"
    }
  ],
  "maxItems": 10
}' |
apify call thescrapelab/bug-bounty-program-finder --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=thescrapelab/bug-bounty-program-finder",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Aycj6G8MZVTgSHxfx/builds/M3KaGFTXmM5Tw3lvP/openapi.json