bounty.index

bounty.index is a free research index that gathers public bug bounty and vulnerability disclosure programs from major platforms into one searchable view. Instead of visiting several directories and learning a different filter system on each, a security researcher can search programs together, filter by payout and asset type, and sort the results by reward, recency, name, or an opportunity score. The site also separates paying bounties from disclosure programs and exposes available safe harbor data where a source publishes it in a structured way. No account is required for basic browsing, which makes it useful for quickly checking the market before deciding where to spend research time.

The program browser covers HackerOne, Bugcrowd, Intigriti, YesWeHack, Federacy, and Immunefi. Search can match a program name or an in-scope identifier, while filters narrow results by platform, asset type, minimum reward, program type, and available safe harbor status. Asset categories include web addresses, wildcards, APIs, mobile apps, source code, hardware, and smart contracts. Each program record links the summarized information back to its source platform, so the index works as a discovery layer rather than a replacement for the program's current policy. Results can also be exported as CSV or JSON when someone wants to rank or analyze the dataset outside the browser. Keyboard navigation lets a researcher move through the result list and open a selected program without leaving the keys, which is useful when reviewing many possible targets in one session.

A separate scope lookup reverses the normal search. A researcher can paste a domain, subdomain, or wildcard and see every indexed program that includes it, along with a warning when it is explicitly out of scope. That is useful during reconnaissance, when the immediate question is whether an observed asset belongs to any known public program. The opportunity score offers another way to prioritize work by combining payout, whether the listing is a bounty or disclosure program, and freshness into a published formula. The score is a shortcut for sorting, not a prediction that a target will produce a valid finding, and researchers still need to read the original rules before testing anything.

The index is rebuilt through a documented daily pipeline. Data for five platforms comes from the public bounty-targets-data mirror, while Immunefi is collected directly. Platform specific records are normalized into a common shape, meaningful fields are hashed, and unchanged programs don't create another snapshot. That sparse history powers views for newly added programs, scope changes, reward changes, and timelines. RSS feeds are available for new programs, the wider change log, and reward changes, while Discord alerts provide another monitoring option. The project publishes both its source and its scoring method, giving technical users a way to inspect how results are assembled rather than treating the ranking as an opaque recommendation.

bounty.index also exposes a public beta MCP endpoint for agents and compatible developer tools. It requires no API key or signup and includes tools for searching programs, fetching a full record, listing scope, reverse scope lookup, viewing recent changes, finding similar programs, following a program timeline, and retrieving payout or platform statistics. Bulk operations can look up several assets or program records in one request. Prepared prompts support target triage, high payout discovery, and weekly change summaries. A live statistics resource lets a client retrieve overall market totals without first invoking a tool. This makes the service useful both to individual hunters working in the browser and to developers building a repeatable research assistant around the same public index.

The product is free, has no paid tier in sight, and makes optional GitHub sign in available for syncing a watchlist across devices. The site says it doesn't ask for an email, serves no ads, and uses anonymous pageview analytics rather than tracking cookies. Its public source is MIT licensed, but the simplest way to use it is still the hosted site. There are a few clear limits. Coverage depends on the upstream feeds and on what each platform publishes, so the index can lag or omit policy details. Safe harbor filtering is currently limited by structured source coverage. The MCP service is still labeled beta, and the site showed a live data pause during review, with programs falling back to an upstream mirror while watchlists and alerts were temporarily unavailable. It is a strong discovery and monitoring layer, but the authoritative rules and permission to test always remain on the original program page.