I Built a Tool That Finds Bug Bounty Programs Across 4 Platforms

The problem

When you start bug bounty hunting, the first question is not "how do I find a bug?" It's "where should I look?"

Every platform has its own program list, its own filters, and its own way of describing scope. If you want every program that includes an Android app, or every unpaid program with a web target, you end up opening four websites and comparing them by hand.

I'm a cybersecurity student, and I wanted one place where I could type a keyword like android or api and see matching programs from every major platform. So I built it.

What it does

Bounty Target Finder is a small web app that runs on your own computer. You type a scope keyword and choose a reward type, and it shows matching programs from HackerOne, Bugcrowd, Intigriti and YesWeHack.

• Search by any keyword, or several at once. Use * to see everything.
• Filter by unpaid programs (VDPs that offer swag, reputation or hall of fame, which often means less competition), cash bounties, or all programs.
• Mix the platforms evenly or group results by platform.
• Download the full results as JSON or CSV.

At the time of writing, searching everything returns 927 programs across the four platforms.

Important: the tool only lists public programs. It never scans or connects to any target.

Where the data comes from

I didn't scrape the platforms. The open-source project bounty-targets-data publishes hourly-updated program data for each platform. Using that is more respectful to the platforms and much more reliable than scraping their pages.

The app refreshes its data at most once an hour, no matter how many searches you run.

Responsible use

A tool like this makes it easy to find programs, so it's worth being clear about the rules:

1. A listing is not permission. Read each program's current policy and test only assets that are in scope.
2. The data can be out of date. Scope changes and programs close. Always confirm on the program's own page.
3. Unpaid doesn't mean rule-free. VDPs have rules too.
4. This project is not affiliated with HackerOne, Bugcrowd, Intigriti or YesWeHack.

What's next

Ideas I'm considering: a dark mode, filtering by asset type (websites, mobile apps, source code), saving favorite programs, and a "new this week" view.

If you try it and have feedback or a feature idea, I'd love to hear it.

GitHub: https://github.com/Mumer3/bounty-target-finder