An XXE vulnerability was identified...
", "activityTimeline": [ { "key": "submission.created", "verb": "created the submission", "actorName": "thomasito", "createdAt": "2025-10-26T00:04:45Z", "substate": null, "isComment": false }, { "key": "comment.created", "verb": "sent a", "actorName": "brunoc_bugcrowd", "createdAt": "2025-10-27T11:23:02Z", "substate": null, "isComment": true } ], "reportUrl": "https://bugcrowd.com/disclosures/8c24664f-682e-43b6-83eb-885508405ac3/xml-external-entity-injection-in-nasa-cmr-ingest-api-info-dump" } } ``` `fullReport` is only populated when `hacktivityIncludeFullReport: true` **and** the row is publicly disclosed; otherwise it's `null`. Note `activityTimeline` entries carry event metadata (who, when, what kind of event) but not the actual text of each comment — Bugcrowd doesn't render individual comment bodies on the public disclosure page (see "Known limitations" below). **`programs`** (with `programsIncludeScope: true, programsIncludeBountyTable: true`): ```json { "mode": "programs", "name": "Nubank Brasil Managed Bug Bounty Program", "programUrl": "https://bugcrowd.com/engagements/nubank", "rewardSummary": "$50 - $4,000", "minReward": "$50", "maxReward": "$4,000", "industryName": "Finance", "accessStatus": "open", "engagementTypeLabel": "Bug Bounty", "scopeRank": 4, "targetGroups": [ { "groupName": "Core Assets", "inScope": true, "targets": [ { "name": "Nubank Android: Play Store", "uri": "https://play.google.com/store/apps/details?id=com.nu.production", "category": "android", "tags": ["Android"] }, { "name": "prod-*.nubank.com.br", "uri": null, "category": "api", "tags": [] } ] }, { "groupName": "Out of Scope", "inScope": false, "targets": [ { "name": "*.nuinternational.com", "uri": null, "category": null, "tags": [] } ] } ], "bountyTiers": [ { "groupName": "Core Assets", "inScope": true, "p1": { "min": 2000, "max": 4000 }, "p2": { "min": 1000, "max": 2000 }, "p3": { "min": 300, "max": 600 }, "p4": { "min": 50, "max": 100 } }, { "groupName": "Primary Assets", "inScope": true, "p1": { "min": 1000, "max": 2000 }, "p2": { "min": 600, "max": 1000 }, "p3": { "min": 300, "max": 400 }, "p4": { "min": 50, "max": 100 } } ] } ``` `targetGroups` and `bountyTiers` are only fetched when `programsIncludeScope` / `programsIncludeBountyTable` are `true` — both `null` by default. They're derived from the same public, unauthenticated source: the program's engagement-brief "Targets" tab data (see "Known limitations" for how this was found and verified). `targetGroups` is `[{groupName, inScope, targets: [{name, uri, category, tags}]}]`; `bountyTiers` is `[{groupName, inScope, p1..p5: {min, max}}]` (whole-currency units, USD for USD-priced programs) — reward ranges can differ per target group within the same program. You can download the dataset in various formats such as JSON, HTML, CSV, or Excel from the **Storage → Dataset** tab or via the API. ### Data table | Field | Modes | Description | |---|---|---| | `mode` | all | Which mode produced this row. | | `engagementName`, `engagementUrl`, `target`, `priority`, `points`, `submissionStateText` | `hacktivity` | Crowdstream activity row: program, target, severity priority, points awarded, human-readable state. | | `researcherUsername`, `researcherProfileUrl` | `hacktivity` | The researcher credited, if their name is public on that row (some rows are anonymized by the researcher's own privacy settings). | | `disclosed`, `disclosureReportUrl`, `title`, `disclosedAt` | `hacktivity` | Only on the **disclosed** feed (`hacktivityDisclosedOnly: true`): whether the submission was publicly disclosed, the link to its public disclosure report page, the report's own title, and the disclosure date. The unfiltered feed does not carry any of these — Bugcrowd returns `disclosed: null` and omits the rest on accepted-but-undisclosed activity. | | `fullReport` | `hacktivity` | Only when `hacktivityIncludeFullReport: true` and `disclosed: true`: `{title, summaryAuthor, summaryText, summaryHtml, activityTimeline, reportUrl}` — the full researcher write-up plus a public activity/event timeline (not full comment text; see Known limitations). `null` otherwise. | | `name`, `programUrl`, `rewardSummary`, `minReward`, `maxReward`, `industryName`, `accessStatus`, `scopeRank` | `programs` | Program directory listing: name, reward range, industry, whether it's open or invite-only, and a 1-5 scope difficulty rank. | | `targetGroups` | `programs` | Only when `programsIncludeScope: true`: the program's target-group/asset scope list, `[{groupName, inScope, targets: [{name, uri, category, tags}]}]`, from the program's public engagement-brief page. `null` when the flag is off or the fetch failed. | | `bountyTiers` | `programs` | Only when `programsIncludeBountyTable: true`: the program's P1-P5 reward table per target group, `[{groupName, inScope, p1..p5: {min, max}}]`. `null` when the flag is off or the fetch failed. | ### Pricing The current price of every event is on the **Pricing** tab of this Actor's page in Apify Store. That tab is generated from the Actor's own pricing record, so it is always current, and your plan's rung is applied automatically. A figure repeated here would be a second copy that drifts out of date. You can cap what any single run may spend with **Max total charge**. ### Tips - Turn on **Disclosed reports only** when you want report titles, disclosure dates and write-ups: 878 of the feed's 1,201 rows are disclosed (measured 2026-11-03), and the other 323 carry metadata only. - Use `startPage` to resume a large crawl without re-scraping earlier pages. - Both endpoints used by this Actor responded without a proxy or special headers, re-verified 2026-11-03. Only enable **Proxy configuration** (residential recommended) if you start seeing blocking or Cloudflare challenges — it's off by default to keep runs cheap and fast. ### Known limitations - **Program scope/target lists and P1-P5 reward tables ARE public — no login needed.** An earlier version of this Actor claimed this data required a Bugcrowd researcher login, based on testing only the `/engagements/` endpoint (it now answers 404, "Resource not
found - Crowdcontrol") and `bugcrowd.com/leaderboard` no longer serves a public
server-rendered page: it returns the Bugcrowd **Hacker Portal** SPA shell, whose own
configuration points at `identity.bugcrowd.com/login`. The rankings now live inside
that authenticated portal, and this Actor does not scrape behind a login — so the mode
and its charged event are gone rather than left advertised and failing on first use.
- **Full reports need `hacktivityDisclosedOnly`.** The unfiltered Crowdstream feed carries
no `disclosure_report_url` at all (measured 2026-11-03: `disclosed: null` on every row of
the default feed), so `hacktivityIncludeFullReport` on its own could never fetch
anything. The feed's two page toggles turned out to be a real query parameter —
`crowdstream.json?filter_by=disclosures` returns 878 rows, `filter_by=accepted` 323, and
878 + 323 is exactly the unfiltered 1,201 — and every row under `disclosures` carries a
disclosure report URL. That parameter is now `hacktivityDisclosedOnly`, which is what
makes the full-report feature reachable.
- **Keyword search exists for `programs`, not for `hacktivity`.** The
public program directory page has a real search box; it fires `GET
/engagement_listings.json?search=