Bounty Index

Every public bounty program. One index.

8 followers

Every public bounty program. One index.

8 followers

Aggregated index of bug bounty and VDP programs across every major platform. 1,352 public programs across five platforms — filtered by scope, asset type, and payout. Top of the leaderboard: $15,000,000.

Free

Launch tags:Open Source•Developer Tools•GitHub

Launch Team

Framer AI AgentsDesign and publish professional sites with AI

Promoted

Maker

📌

Hey Product Hunt 👋 I'm Varun. I built bounty.index because I do bug bounty work myself, and the workflow around "what's new to look at today" was broken for me. The existing options: HackerOne and Bugcrowd only show their own programs. arkadiyt/bounty-targets-data dumps raw JSON on GitHub — great data, no product. bbradar.io has a real product but paywalls the interesting parts (scope-change RSS, alerts, API) behind €89/yr. The free, polished, cross-platform, change-aware middle was empty. So I built it. bounty.index aggregates 1,351 programs across 6 platforms (HackerOne, Bugcrowd, Intigriti, YesWeHack, Federacy, Immunefi — the last one scraped directly because it's not in Arkadiyt's dataset), indexes ~50,000 in-scope assets, and snapshots every program daily so you can see what changed. Paste a domain into scope-lookup, get every program it appears in. Watch a program, see diffs. Every program has an RSS feed of scope changes. Free. The scope expanded a lot while building. I killed and un-killed authentication. Killed email alerts permanently in favor of RSS. Learned that the actual moat isn't the UI — it's the accumulated snapshot history, which compounds every day the scrapers run. Solo project, live at bountyindex.in, source at github.com/Varun2024/Bounty-index. What I'd love feedback on: if you hunt bounties, what's the one thing that would make you check this daily instead of your current workflow? And if you don't hunt but see a use case I'm missing, tell me — I've heard "recon target list for red-teamers" and "compliance-scope monitoring" from early users and I'm still figuring out which audience to sharpen for.

Report

2mo ago

Forum Threads

p/bounty-index

•

16d ago

Discord alerts shipped → bountyindex.in/settings/discord

Solving the biggest thing that was losing us users : if you watched a program on bounty.index, you never got told when it changed. You had to come back and check. That's a bad deal.

Fixed via Discord webhooks. Paste a webhook URL from your own server, pick which program should fire it, done. When the daily ingest detects a scope, reward, or safe-harbor change on that program, an embed lands in your channel within seconds. Up-arrow if it went up, down if it dropped, green for pure additions, amber if there's removals.

Setup is ~1 minute, no code. Server / channel settings Integrations Webhooks copy URL paste on our /settings/discord page. There's a test button on every row so you can smoke-test the wiring immediately, no waiting for a real diff.

p/bounty-index

•

19d ago

MCP server is live at mcp.bountyindex.in.

MCP (Model Context Protocol) is a way to plug your app into Claude Desktop / Cursor / Codex, so the agent can call your tools directly instead of you copy-pasting stuff back and forth.

8 read-only tools : search programs, get a program with its full scope, reverse-lookup a URL/domain to whichever program covers it, what's-new across all platforms, similar programs by shared scope, snapshot timeline for a program, list platforms, and a stats one.

So instead of opening the site and filtering, you can tell your agent "which of these subdomains is in scope somewhere" and it just answers. Or "find me public programs paying $10k+ with a wildcard and no auth" one turn, no tabs.

p/bounty-index

•

19d ago

Shipped a small page today : /reward-changes.

It's the same daily snapshot diff /whats-new already uses, just filtered down to the rows where the max payout actually changed. Nothing else no scope adds, no policy edits, just who bumped their reward and who cut it. Up-arrow if it went up, down if it dropped.

30 days by default, 7d/30d/90d shortcuts, RSS at /reward-changes.xml.

View all

Forum Threads

p/bounty-index

•

16d ago

Discord alerts shipped → bountyindex.in/settings/discord

Solving the biggest thing that was losing us users : if you watched a program on bounty.index, you never got told when it changed. You had to come back and check. That's a bad deal.

p/bounty-index

•

19d ago

MCP server is live at mcp.bountyindex.in.

MCP (Model Context Protocol) is a way to plug your app into Claude Desktop / Cursor / Codex, so the agent can call your tools directly instead of you copy-pasting stuff back and forth.

p/bounty-index