Bugcrowd Scraper

Bugcrowd Scraper extracts publicly visible data from Bugcrowd, the crowdsourced security/bug bounty platform, in two modes: the public Crowdstream ("hacktivity" equivalent — accepted/disclosed submission activity) and the public bug bounty program directory. It calls Bugcrowd's own JSON endpoints directly (the same ones bugcrowd.com's own pages use), so it's fast and doesn't render pages in a browser. Run it on the Apify platform to get scheduling, API access, webhooks, and dataset export for free.

Why use Bugcrowd Scraper?

• Bug bounty market research — see which companies run public programs, their reward ranges, industries, and access status (open vs. invite-only).
• Vulnerability activity tracking — monitor the public Crowdstream feed for accepted/disclosed submission activity across programs, by priority (P1-P5) and target.
• Disclosed vulnerability research — pull only publicly disclosed submissions, with their report titles, disclosure dates and (optionally) the researcher's full write-up.
• Competitive/vendor due diligence — check whether a vendor runs a Bugcrowd program and what its reward structure looks like before engaging.

How to use Bugcrowd Scraper

1. Click Try for free (or Run) on this Actor's page.
2. Pick a Mode: hacktivity (Crowdstream activity) or programs (program directory).
3. Set Max items (0 = unlimited). This counts rows actually delivered, so duplicates and unresolved rows never eat into it.
4. Optionally set a Start page to resume/skip ahead.
5. For programs, optionally set a Search query (e.g. "okta" or "bank") to narrow the directory to matching programs, using the same search Bugcrowd's own program directory page offers. Not available for hacktivity — Bugcrowd's public Crowdstream page has no keyword search.
6. For hacktivity, optionally turn on Disclosed reports only to get just the publicly disclosed submissions — the ones that carry a report title, a disclosure date and a disclosure report URL.
7. Optionally turn on Include full report (hacktivity, requires Disclosed reports only), or Include target scope / Include bounty tiers (programs) for deeper per-row detail — each costs 1-2 extra HTTP requests (and a small extra charge) per row. See Known limitations below for the one piece of data that's genuinely not public (individual comment text).
8. Click Start and watch results land in the dataset in real time.

Input

Field	Type	Description
mode	string	hacktivity or programs. Required.
maxItems	integer	Max rows to deliver (0 = unlimited). Default 100.
startPage	integer	1-indexed page to start from. Default 1.
hacktivityDisclosedOnly	boolean	hacktivity only. Return only publicly disclosed submissions, via the Crowdstream feed's own "Disclosed reports" toggle (filter_by=disclosures). These are the rows that carry title, disclosedAt and disclosureReportUrl. Default false.
hacktivityIncludeFullReport	boolean	hacktivity only. Fetch each disclosed submission's full write-up + public activity timeline (1 extra request per disclosed row). Requires hacktivityDisclosedOnly — see caveats below. Default false.
programsIncludeScope	boolean	programs only. Fetch each program's target-group/scope list (1-2 extra requests per program, shared with programsIncludeBountyTable). Default false.
programsIncludeBountyTable	boolean	programs only. Fetch each program's full P1-P5 reward table per target group (1-2 extra requests per program, shared with programsIncludeScope). Default false.
programsSearchQuery	string	programs only. Keyword/text search over the program directory -- the real search param used by bugcrowd.com/engagements' own search box (verified live: e.g. "okta" narrows the ~250-program directory to 5 results). Full-text, not just a name match. Blank = full unfiltered directory. Not available for hacktivity -- Bugcrowd's public Crowdstream page has no text search.
proxyConfiguration	object	Optional proxy config. Not required — see Tips below.

See the Input tab for the full schema with defaults.

Output

Each dataset item is one row from the selected mode. Examples:

hacktivity:

{
  "mode": "hacktivity",
  "id": "13bd6066-7fdb-46c1-a464-7ac1af833486",
  "engagementName": "ClickHouse",
  "engagementUrl": "https://bugcrowd.com/engagements/clickhouse",
  "researcherUsername": "0x88",
  "researcherProfileUrl": "https://bugcrowd.com/h/0x88",
  "points": 5,
  "priority": 4,
  "target": "https://cloud.langfuse.com/",
  "submissionStateText": "Submission accepted on target: https://cloud.langfuse.com/",
  "acceptedAt": "16 Aug 2026",
  "disclosed": true,
  "disclosureReportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump",
  "fullReport": {
    "title": "XML External Entity Injection in NASA CMR Ingest API - info dump",
    "summaryAuthor": "thomasito",
    "summaryText": "An XXE vulnerability was identified in NASA's Common Metadata Repository that enabled unauthenticated arbitrary file reads and server-side request forgery (SSRF). ...",
    "summaryHtml": "<p>An XXE vulnerability was identified...</p>",
    "activityTimeline": [
      { "key": "submission.created", "verb": "created the submission", "actorName": "thomasito", "createdAt": "2025-10-26T00:04:45Z", "substate": null, "isComment": false },
      { "key": "comment.created", "verb": "sent a", "actorName": "brunoc_bugcrowd", "createdAt": "2025-10-27T11:23:02Z", "substate": null, "isComment": true }
    ],
    "reportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump"
  }
}

fullReport is only populated when hacktivityIncludeFullReport: true and the row is publicly disclosed; otherwise it's null. Note activityTimeline entries carry event metadata (who, when, what kind of event) but not the actual text of each comment — Bugcrowd doesn't render individual comment bodies on the public disclosure page (see "Known limitations" below).

programs (with programsIncludeScope: true, programsIncludeBountyTable: true):

{
  "mode": "programs",
  "name": "Nubank Brasil Managed Bug Bounty Program",
  "programUrl": "https://bugcrowd.com/engagements/nubank",
  "rewardSummary": "$50 - $4,000",
  "minReward": "$50",
  "maxReward": "$4,000",
  "industryName": "Finance",
  "accessStatus": "open",
  "engagementTypeLabel": "Bug Bounty",
  "scopeRank": 4,
  "targetGroups": [
    {
      "groupName": "Core Assets",
      "inScope": true,
      "targets": [
        { "name": "Nubank Android: Play Store", "uri": "https://play.google.com/store/apps/details?id=com.nu.production", "category": "android", "tags": ["Android"] },
        { "name": "prod-*.nubank.com.br", "uri": null, "category": "api", "tags": [] }
      ]
    },
    { "groupName": "Out of Scope", "inScope": false, "targets": [ { "name": "*.nuinternational.com", "uri": null, "category": null, "tags": [] } ] }
  ],
  "bountyTiers": [
    { "groupName": "Core Assets", "inScope": true, "p1": { "min": 2000, "max": 4000 }, "p2": { "min": 1000, "max": 2000 }, "p3": { "min": 300, "max": 600 }, "p4": { "min": 50, "max": 100 } },
    { "groupName": "Primary Assets", "inScope": true, "p1": { "min": 1000, "max": 2000 }, "p2": { "min": 600, "max": 1000 }, "p3": { "min": 300, "max": 400 }, "p4": { "min": 50, "max": 100 } }
  ]
}

targetGroups and bountyTiers are only fetched when programsIncludeScope / programsIncludeBountyTable are true — both null by default. They're derived from the same public, unauthenticated source: the program's engagement-brief "Targets" tab data (see "Known limitations" for how this was found and verified). targetGroups is [{groupName, inScope, targets: [{name, uri, category, tags}]}]; bountyTiers is [{groupName, inScope, p1..p5: {min, max}}] (whole-currency units, USD for USD-priced programs) — reward ranges can differ per target group within the same program.

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from the Storage → Dataset tab or via the API.

Data table

Field	Modes	Description
mode	all	Which mode produced this row.
engagementName, engagementUrl, target, priority, points, submissionStateText	hacktivity	Crowdstream activity row: program, target, severity priority, points awarded, human-readable state.
researcherUsername, researcherProfileUrl	hacktivity	The researcher credited, if their name is public on that row (some rows are anonymized by the researcher's own privacy settings).
disclosed, disclosureReportUrl, title, disclosedAt	hacktivity	Only on the disclosed feed (hacktivityDisclosedOnly: true): whether the submission was publicly disclosed, the link to its public disclosure report page, the report's own title, and the disclosure date. The unfiltered feed does not carry any of these — Bugcrowd returns disclosed: null and omits the rest on accepted-but-undisclosed activity.
fullReport	hacktivity	Only when hacktivityIncludeFullReport: true and disclosed: true: {title, summaryAuthor, summaryText, summaryHtml, activityTimeline, reportUrl} — the full researcher write-up plus a public activity/event timeline (not full comment text; see Known limitations). null otherwise.
name, programUrl, rewardSummary, minReward, maxReward, industryName, accessStatus, scopeRank	programs	Program directory listing: name, reward range, industry, whether it's open or invite-only, and a 1-5 scope difficulty rank.
targetGroups	programs	Only when programsIncludeScope: true: the program's target-group/asset scope list, [{groupName, inScope, targets: [{name, uri, category, tags}]}], from the program's public engagement-brief page. null when the flag is off or the fetch failed.
bountyTiers	programs	Only when programsIncludeBountyTable: true: the program's P1-P5 reward table per target group, [{groupName, inScope, p1..p5: {min, max}}]. null when the flag is off or the fetch failed.

Pricing

The current price of every event is on the Pricing tab of this Actor's page in Apify Store. That tab is generated from the Actor's own pricing record, so it is always current, and your plan's rung is applied automatically. A figure repeated here would be a second copy that drifts out of date.

You can cap what any single run may spend with Max total charge.

Tips

• Turn on Disclosed reports only when you want report titles, disclosure dates and write-ups: 878 of the feed's 1,201 rows are disclosed (measured 2026-11-03), and the other 323 carry metadata only.
• Use startPage to resume a large crawl without re-scraping earlier pages.
• Both endpoints used by this Actor responded without a proxy or special headers, re-verified 2026-11-03. Only enable Proxy configuration (residential recommended) if you start seeing blocking or Cloudflare challenges — it's off by default to keep runs cheap and fast.

Known limitations

• Program scope/target lists and P1-P5 reward tables ARE public — no login needed. An earlier version of this Actor claimed this data required a Bugcrowd researcher login, based on testing only the /engagements/<handle>/target_groups.json and /rewards.json routes (which do redirect to the login-gated Hacker Portal). That conclusion was wrong: the real bugcrowd.com engagement brief page (e.g. bugcrowd.com/engagements/nubank) renders a full "Targets" tab — target-group names, in/out-of-scope status, per-asset name/URI/category/tags, and a P1-P5 reward table per target group — without any login, verified with a real headless-browser session on a logged-out page. That page fetches the data from

  GET /engagements/<handle>/ changelog.json
  (list of published brief revisions) then

  GET /engagements/<handle>/ changelog/<id>.json
  (full detail for the "Latest" revision), both confirmed public with a bare curl (no cookies, no proxy) across open bug-bounty programs (nubank, okta) and VDPs (nasa-vdp) alike. programsIncludeScope / programsIncludeBountyTable now use this real mechanism and return real data. The scope-adjacent scopeRank (1-5 difficulty score) remains included on every programs row regardless of these flags, as before.
• Full comment text on disclosed submissions is not public. hacktivityIncludeFullReport successfully fetches the full researcher write-up (the actual vulnerability description/PoC) from each disclosed submission's public disclosure page — that part works reliably. Its activityTimeline, however, only carries comment/state-change metadata (who, when, what kind of event) because Bugcrowd's public disclosure page doesn't render individual comment bodies server-side; that content is fetched by the same login-gated Hacker Portal SPA as above.
• The researcher leaderboard mode was removed on 2026-11-03. Bugcrowd retired the public GET /leaderboard/data?period=<p> endpoint (it now answers 404, "Resource not found - Crowdcontrol") and bugcrowd.com/leaderboard no longer serves a public server-rendered page: it returns the Bugcrowd Hacker Portal SPA shell, whose own configuration points at identity.bugcrowd.com/login. The rankings now live inside that authenticated portal, and this Actor does not scrape behind a login — so the mode and its charged event are gone rather than left advertised and failing on first use.
• Full reports need hacktivityDisclosedOnly. The unfiltered Crowdstream feed carries no disclosure_report_url at all (measured 2026-11-03: disclosed: null on every row of the default feed), so hacktivityIncludeFullReport on its own could never fetch anything. The feed's two page toggles turned out to be a real query parameter — crowdstream.json?filter_by=disclosures returns 878 rows, filter_by=accepted 323, and 878 + 323 is exactly the unfiltered 1,201 — and every row under disclosures carries a disclosure report URL. That parameter is now hacktivityDisclosedOnly, which is what makes the full-report feature reachable.
• Keyword search exists for programs, not for hacktivity. The public program directory page has a real search box; it fires

  GET /engagement_listings.json?search=<term>&...
  , and the same search param also works on the engagements.json endpoint this Actor already uses for programs (confirmed live: search=okta narrows Bugcrowd's ~250-program directory to 5 hits, search=bank to ~40, a nonsense term to 0) — wired up as programsSearchQuery. The public Crowdstream page, by contrast, has no text search box and no search-style query parameter on crowdstream.json — only the accepted/disclosed toggle, which is covered by hacktivityDisclosedOnly. No fabricated search param was added for hacktivity.
• No public per-researcher "track record". Each researcher's /h/<username> profile page is a client-rendered SPA shell with no embedded data and no discovered public JSON API (the page is identical in size/shape whether logged in or not, and ships no server-rendered stats). Track-record data (badges, first-to-find count, per-program point breakdown, response history) is not available without a login, so no researchers mode was added rather than fabricate one.

Cyber recon toolkit

Part of the Cyber recon toolkit — OSINT, attack-surface recon, and vulnerability-intel data collection for security research:

• HackerOne Scraper — Scrapes public HackerOne data: Hacktivity disclosed reports, program directory, researcher leaderboard.
• Intigriti Scraper — Scrapes public Intigriti data: bug bounty/VDP program directory, researcher leaderboard and profiles.
• CVE Scraper — CVE.org vulnerability info scraper.
• TLSX - TLS Data Gathering and Analysis — Fast, configurable TLS grabber for TLS-based data collection and analysis.
• BGP.HE.NET Recon Scraper — Scrapes ASN, prefix, IP, and DNS recon data from bgp.he.net.
• gau - Get All URLs — Fetch known URLs from Wayback Machine, Common Crawl, AlienVault OTX, and URLScan.
• Git Email Extractor — Shallow-clones git repos and extracts contributor emails from commit history.
• Wappalyzer Technology Lookup — Detect the technology stack behind any website using Wappalyzer.
• Meta Tags Scraper — Web page metadata scraper (meta tags, Open Graph, Twitter Card).
• Universal Contact Extractor — Extract phone numbers, emails and social media URLs from web pages.
• Web Text Extractor — Extract clean text or Markdown content from web pages.

Did you find this useful?

Rate this actor on Apify! Your feedback helps other users find it and helps us keep improving it.

FAQ & disclaimers

This Actor only accesses publicly visible Bugcrowd data — the same Crowdstream and program directory pages anyone can view at bugcrowd.com without logging in. It does not use, require, or store login credentials, and it cannot access private program details, non-public submissions, or authenticated researcher data. There is no crawlable public directory of individual researcher profiles: each researcher's /h/<username> profile page is a client-rendered single-page app with no discovered public JSON API, so a separate "researchers" mode was not implemented. The researcher leaderboard was a public page when this Actor was written; Bugcrowd has since moved it inside its login-gated Hacker Portal, so that mode was removed on 2026-11-03 rather than kept behind a login.

Use this Actor in accordance with Bugcrowd's Terms of Service. Website structures and APIs can change — if the Actor stops returning data, please open an issue on the Actor's Issues tab. Need a custom variant (different fields, sites, or pipelines)? Reach out via Apify's custom development services.