Post cover image

November 4, 2026

I Audited 24 Bug Bounty Tools. Seven Haven’t Been Touched in Two Years.

One author. Thirteen commits. Four thousand five hundred stars.

By Raj Namdev

8 min read

30-second version:_ I pulled the commit history, top-author share, and last-push date for 24 tools that make up a standard bug bounty recon stack. The finding nobody's written down: across 15 of them, the top-commit slot belongs to just 10 distinct humans — and 7 of those 15, including three of the most-starred URL tools in the field, haven't received a single commit in over two years. Here's the data, the two curl commands to audit any tool before you depend on it, and the line I use to decide when to install a tool versus write it myself._

Open the methodology section of almost any published bug bounty writeup and the same names fall out: subfinder, httpx, waybackurls, nuclei, ffuf, gf. They read like an industry — a stack of products you install.

So this morning I stopped treating them like products and audited them like dependencies. GitHub's API gives you everything you need: who commits, how much, and when they stopped. I pulled 24 repos — the tools that recur across recon frameworks and published workflows, plus the frameworks themselves (reconFTW's install script alone references 13 of the others).

Start with the one that made me write this article.

One author. Thirteen commits. Four thousand five hundred stars.

waybackurls — tomnomnom's tool that fetches every URL the Wayback Machine knows for a domain — sits in more recon pipelines than any other URL gatherer I can name. It has 4,599 stars and 551 forks.

The entire commit history of that repo, per GitHub's contributors endpoint, is 13 commits by one author. The first was January 2018. The last was May 1, 2024–30 months ago. Nobody has merged anything since. Nothing is archived, nothing is deprecated, the README still says what it always said. The repo reads as alive to anyone who doesn't check pushed_at.

That's 354 stars per commit, on a tool your pipeline calls every single run.

I assumed this was an outlier. It's the pattern.

What I measured, and how

Everything below comes from two GitHub API endpoints, fetched November 2, 2026. You can run the same audit on any tool before you add it to your stack:

curl -s "https://api.github.com/repos/tomnomnom/waybackurls" \
  | jq '{stars: .stargazers_count, pushed: .pushed_at, archived}'
curl -s "https://api.github.com/repos/tomnomnom/waybackurls/contributors?per_page=100" \
  | jq '{authors: length, top_author: .[0].login, top_commits: .[0].contributions,
         total: ([.[].contributions] | add)}'

The contributors endpoint returns each author's commits to the default branch, ranked, up to 100 authors. "Top-author share" below is the top author's commits divided by the total across everyone listed. For small repos that's the entire history — for waybackurls, all 13 commits. For the biggest repos it's measured among their 100 most active contributors. Either way, the shape holds: a team-maintained tool spreads commits thin, a one-person tool doesn't.

The 24 repos split cleanly into two layers. In fifteen, the top-commit slot belongs to a single account — one person owns the largest share of the history. The other nine are maintained by institutions: ProjectDiscovery's eight repos plus Truffle Security's trufflehog. The two layers are aging very differently.

The single-maintainer layer: 15 tools, 10 people

Tool Top author Stars Top-author commit share Last push gitleaks zricethezav (Zachary Rice) 30,605 63% Oct 2026 ffuf joohoi (Joona Hoikkala) 16,974 70% Sep 2026 Amass caffix (Jeff Foley) 15,455 84% Oct 2026 bbot TheTechromancer 10,916 50% Nov 2, 2026 reNgine yogeshojha 8,912 85% Oct 31, 2026 reconFTW six2dez 8,325 83% Nov 2, 2026 dalfox hahwul 5,355 79% Nov 1, 2026 gau lc 5,154 31% Oct 2026 waybackurls tomnomnom 4,599 100% May 2024 axiom 0xtavian 4,443 66% Sep 2024 assetfinder tomnomnom 3,697 67% Jun 2024 httprobe tomnomnom 3,123 95% Jun 2024 gf tomnomnom 2,131 69% Jun 2024 anew tomnomnom 1,659 63% Jan 2024 unfurl tomnomnom 1,343 75% Aug 2023

Count the distinct names in the second column. Ten people. Ten accounts hold the top-commit slot across fifteen tools with a combined 122,691 stars. The median top-author share is 70%. Six of the fifteen belong to one person — the account tomnomnom, whose GitHub bio just says "Open-source tool maker."

Those six repos total 137 commits between them. That's the entire measured history of six tools with 16,552 stars. He wrote them for himself, the shape of each one is obvious the minute you use them, and the field adopted them as infrastructure.

The point isn't that these tools are bad. The opposite — 13 commits that do one thing perfectly is good engineering. The point is what the field built on top of it. Every pipeline that pipes waybackurls output into gf patterns is running on a dependency whose maintainer stopped two and a half years ago, and nobody's renewal notice ever arrives.

The frozen seven

Seven of the fifteen haven't been pushed to in more than two years. Not one of them is archived, so nothing announces the freeze.

Tool Last push Months silent What your pipeline uses it for unfurl Aug 12, 2023 39 URL parsing, param extraction anew Jan 12, 2024 34 Diffing today's results against yesterday's waybackurls May 1, 2024 30 URL gathering from web archives assetfinder Jun 7, 2024 29 Passive subdomain discovery gf Jun 8, 2024 29 Pattern-matching grep for injection points httprobe Jun 22, 2024 28 Probing which subdomains are alive axiom Sep 30, 2024 25 Distributing scans across cloud instances

Look at what's on that list. Not scanners. Not engines. Plumbing — gatherers, probers, parsers, differencers. The generic, unglamorous tools that every workflow runs first.

A frozen repo isn't a broken repo. waybackurls still works today. The risk is structural: these tools sit at the mercy of upstream APIs. waybackurls is a wrapper around the Internet Archive's CDX endpoint. The day that endpoint changes its rate limits or its output format, the 13-commit repo needs its 14th commit — and there is no one on the other end of that request. Your morning pipeline fails, you open the repo, and the last activity was 2024.

axiom is the cautionary tale in the other direction: it did everything right. Its creator, pry0cc, built it in May 2020, and when he stepped back the top contributor became 0xtavian — 764 commits, a real handoff, a real community. It froze anyway, 25 months ago. Handoffs delay the freeze; they don't prevent it. Maintaining someone else's tool is the least rewarding work in security, and it pays exactly nothing.

The company layer only rebuilt half the stack

The other nine repos are maintained by organizations, and the difference in the commit data is stark. The top contributor on ProjectDiscovery's nuclei holds 21% of commits. Truffle Security's trufflehog spreads across 100+ listed contributors with the top account at 13%. Nobody in this layer is load-bearing.

Tool Org Stars Top-account share Last push nuclei ProjectDiscovery 32,543 21% Nov 2, 2026 nuclei-templates ProjectDiscovery 13,276 19% Nov 2, 2026 trufflehog Truffle Security 28,822 13% Nov 2, 2026 subfinder ProjectDiscovery 14,703 32%* Nov 2, 2026 katana ProjectDiscovery 17,786 55%* Nov 2, 2026 httpx ProjectDiscovery 10,570 40%* Nov 2, 2026 naabu ProjectDiscovery 6,347 56%* Nov 2, 2026 interactsh ProjectDiscovery 4,614 59%* Nov 2, 2026 notify ProjectDiscovery 1,625 29%* Nov 2, 2026

  • In six of ProjectDiscovery's eight repos, the single most active committer by raw count is dependabot[bot] — dependency updates run by automation, not a person. That's what institutional maintenance looks like in the data: bots doing the chores, a team doing the work, no single point of failure.

The adoption numbers tell you where the field's confidence actually sits. The official nuclei Docker image has been pulled 1,488,486 times; across the five ProjectDiscovery images I checked, 2.1 million pulls. And nuclei-templates — the community template repository — carries 69,733 commits from its contributors, with the most prolific account showing up as ghost, GitHub's placeholder for an author that no longer resolves. A scanner engine, a template factory, a secrets detector: the parts of the stack that a company could build a business around got institutionalized.

The plumbing didn't. There is no company behind URL gathering, diffing, and probing — the boring half of every recon workflow. The market fixed the monetizable engines and left the glue as favors.

Why nobody gets paid to fix waybackurls

The economics are one line: bug bounty pays for findings, not for tools, and these tools are free. The bounty on one good SSRF report can exceed everything those repos receive in a year of donations. Every hour a maintainer spends keeping httprobe current is an hour not spent hunting — the field's incentive structure quietly taxes the exact people who built its infrastructure.

So the maintainers who kept going are the ones who turned maintenance into the job itself: ProjectDiscovery built a company around the scan layer, Jeff Foley's Amass became an OWASP project, Black Lantern carries bbot. The ones who stayed hobbyists froze. That's not a morality problem. It's just what happens when 122,691 stars and zero revenue meet a Tuesday.

What to do with this

Audit before you adopt. Any time a writeup tells you to install something, run the two commands from earlier first. My thresholds, after this exercise:

  • Top-author share above ~80% — treat it as a one-person bus factor, no matter the star count.
  • Last push over a year old — treat it as frozen. Vendor it or write around it.
  • archived is meaningless — none of these 24 repos is archived. Silence is the signal, not the banner.

Pin what you install. go install ...@latest on a frozen dependency is borrowing trouble. Resolve the tag yourself and pin it:

git ls-remote --tags https://github.com/tomnomnom/waybackurls.git | tail -3
go install github.com/tomnomnom/waybackurls@<tag>

Your pipeline should break because you chose to move a version. Not because upstream moved and you found out at 9am with a queue full of failed runs.

Write the glue. Install the engines. My rule after doing this audit: if the tool is a pipe, write the pipe. If the tool is a state machine, install it.

nuclei is a state machine — a template engine, a matching engine, 69,000 commits of community templates behind it. Never rebuild that. waybackurls is a pipe with one upstream API. The 80% version of it is a single curl you can actually read:

curl -s "http://web.archive.org/cdx/search/cdx?url=example.com/*&output=text&fl=original&collapse=urlkey" \
  | sort -u

That's the CDX query at the heart of the tool — and code you own can't be frozen under you. Same logic applies to the differencing layer. The whole "what's new since yesterday" function of anew is a few lines of shell, and it's the highest-value part of any recon loop, because new assets are where the bugs are:

#!/usr/bin/env bash
# nightly.sh <domain> — flag what changed since the last run
D=$1
subfinder -d "$D" -silent | anew "$D.subs" | tee "$D.new"
[ -s "$D.new" ] || exit 0
httpx -l "$D.new" -silent | anew "$D.live"
notify -provider slack < "$D.new"

Four lines of glue: gather, diff, probe, notify. Every piece is yours. When the Wayback CDX endpoint changes its behavior someday, the fix lands in your script the same day — not in a pull-request queue whose last commit was 30 months ago.

None of this means stop using the community's tools — I'll use most of the 24 tomorrow. It means knowing which half of your stack is an institution and which half is a favor, and pricing your dependencies accordingly.

The stack we all run is held up by ten people, seven frozen repos, and 13 commits at a time. It has carried the field this far.

Sources

All data fetched November 2, 2026, and every number above is from these endpoints — none from memory. Star counts and pull counts move; commit counts and pushed_at dates are the stable facts.

  • GitHub REST API, /repos/{owner}/{repo} — stars, forks, pushed_at, archived, creation dates for all 24 repositories in both tables. Examples: https://api.github.com/repos/tomnomnom/waybackurls · https://api.github.com/repos/projectdiscovery/nuclei
  • GitHub REST API, /repos/{owner}/{repo}/contributors?per_page=100 — author counts, top-author identities, and commit shares for all 24. For single-author repos (waybackurls: 1 author, 13 commits) this is the complete default-branch history; for repos with many contributors it is the share among the listed contributors, which understates concentration if anything, since bots like dependabot inflate the denominator.
  • GitHub users API — maintainer profiles: tomnomnom (Tom Hudson, 14,010 followers, "Open-source tool maker"), joohoi (Joona Hoikkala), caffix (Jeff Foley, OWASP Amass project leader), zricethezav (Zachary Rice), hahwul, six2dez.
  • Docker Hub API — official image pull counts: nuclei 1,488,486; subfinder 208,010; httpx 195,854; naabu 126,719; katana 106,573 (2,125,642 combined).
  • reconFTW install.sh — raw.githubusercontent.com/six2dez/reconftw/main/install.sh — references 13 of the other audited tools (subfinder, httpx, nuclei, ffuf, gf, anew, unfurl, dalfox, interactsh, naabu, katana, trufflehog, axiom), which is how the 24-repo audit set was scoped.
  • Tool descriptions quoted from each repo's own README/description field (e.g., waybackurls: "Fetch all the URLs that the Wayback Machine knows about for a domain").