Bug Bounty Finder - HackerOne + Bugcrowd + security.txt MCP server

Bug Bounty Finder - HackerOne + Bugcrowd + security.txt

Find every public bug bounty or responsible-disclosure program covering a domain - aggregates HackerOne directory, Bugcrowd engagements, and security.txt in one call.

Available as an Apify Actor. Pay-per-event. No subscription. Daily-use tool for bug bounty hunters scoping new targets.

What does it do?

Takes a target domain and returns every public bug bounty program covering it. Aggregates the HackerOne public directory, Bugcrowd engagements page, and the target's own /.well-known/security.txt file (RFC 9116). Returns structured per-program records with platform, program URL, reward range (min/max bounty), report count where available, scope summary, and disclosure policy URL.

How is it different from manual checks across each platform plus visiting security.txt?

Daily-use tool for bug bounty hunters scoping new targets - the first call when evaluating a new acquisition target.

When should I use it?

• Bug bounty target evaluation - 'is there a program for this domain?'
• Responsible disclosure - find the right contact for reporting a vulnerability
• Scope mapping - identify which subdomains are in scope for a known program
• Competitive intel - track which companies offer bug bounties (not all do)
• Compliance research - find vulnerability disclosure policies

What does it cost?

Pay-per-event:

Typical scan costs

• Single domain (~3 programs): $0.015
• Bulk 50 domains (~2 programs each): $0.50

Which inputs does it take?

What does the output look like?

Each dataset record:

{
  "domain": "example.com",
  "source": "hackerone",
  "program_name": "Example Inc",
  "program_url": "https://hackerone.com/example",
  "reward_min": 100,
  "reward_max": 20000,
  "reports_resolved": 142,
  "scope_summary": "Web, API, mobile apps",
  "disclosure_policy_url": "https://hackerone.com/example/policy"
}

Common questions

Q: Does this find private programs? No. Only public programs. Private programs are invitation-only and not enumerable without platform credentials.

Q: Want a daily diff feed of new programs? Planned feature. DM LinkedIn to request priority delivery.

Q: Other platforms (Intigriti, YesWeHack, Synack)? Currently HackerOne + Bugcrowd + security.txt. Other platforms shipped on request within 1-2 hours via LinkedIn DM.

About the maintainer (priority response within 1-2 hours)

Built and maintained by Anshuman Atrey (@AnshumanAtrey).

• Purple-team security researcher, 5x hackathon winner
• Co-founder of Project AISHA (AI cybersec SaaS) and The Drone Syndicate (autonomous defence drones)
• Author of the canonical OSINT actor portfolio on Apify Store: 12+ shipped actors covering email, phone, username, IP/domain, network, secret, social, LinkedIn, and Indian fintech OSINT

Custom feature requests shipped within 1-2 hours (priority)

Shortened. The full README is on GitHub.