BountyHub is being rebuilt

Stop running scripts.
Start running workflows.

BountyHub turns the repetitive parts of security research (recon, scanning, collecting, sorting, and remembering) into reusable workflows that run on infrastructure you control and keep their results as structured, queryable data.

Built for hackers who are tired of re-glueing the same shell commands on every target, and for teams who need to monitor their own attack surface continuously. Write it once, run it forever, and spend your time on the findings instead of the plumbing.

Built for Bug bounty hunters, Security researchers, Pentesters, Security teams.

Private beta coming soon

workflow(
activities = [
activity(
name = "discover",
triggers = [trigger.cron("0 6 * * *")],
steps = [
step.exec(command = ["subfinder", "-d", config.var("domain"), "-o", "subs.txt"]),
step.transform(
source = path.file("subs.txt").lines(),
pipeline = transform.trim().lower().unique(),
destination = path.file("subs-clean.txt"),
),
step.update_dataset(
table = "subdomains",
source = path.file("subs-clean.txt").lines(),
pipeline = transform.unique(),
mapping = {"host": row.value},
mode = dataset.upsert(),
),
],
),
activity(
name = "triage",
triggers = [trigger.on(discover.succeeded())],
steps = [
step.agent(
prompt = "Flag exposed admin panels on new hosts.",
model = model("default"),
provider = provider.key("anthropic/personal"),
output = output.json(),
),
],
),
],
)
datasets/domains · 1,284 rows synced

A real BHW workflow: scheduled discovery, typed transforms, dataset sync, and an AI triage step, written once and rerun on every target.

We're rebuilding BountyHub from the ground up.

The first version tested the idea. The next one will be the platform we actually want to hunt with.

Don't spend brain cycles organizing data and running tools. Let BountyHub do it. You analyze. You exploit. That is what hackers do.

Same workflow, new target, new findings!

One system for research, automation, and data.

Most hunting setups are a pile of shell commands, cron jobs, spreadsheets, and notes that only one person understands. BountyHub gives that process a home: workflows you can reuse, runners you control, and datasets that remember what you found.

Whether you're hunting a new program or watching your own attack surface around the clock, you describe the process once and let BountyHub run it.

Workflows

Build repeatable research.

Turn the commands, tools, and steps you already trust into reusable workflows. Version them, schedule them, and run them again on any target without rebuilding the process from scratch.

Execution

Run on your terms.

Execute on hosted runners or register your own machines as self-hosted runners. Keep proprietary scanners, internal networks, and sensitive targets inside your own infrastructure.

Datasets

Keep every result.

Recon output becomes structured, queryable data instead of a wall of terminal text. Track subdomains, hosts, ports, URLs, and scan results over time and see exactly what changed.

Agents

Automate the busywork.

Add AI agents to a workflow to triage results, chase leads, and operate tools, always within the limits and capabilities you explicitly grant.

Every capability you need to hunt and monitor at scale.

BountyHub is being rebuilt around capabilities that work together instead of existing as isolated features. Discovery feeds datasets, datasets trigger workflows, workflows call agents and runners, and everything that happens is captured as an artifact.

Not everything ships at once. Capabilities will land in stages during the beta. Join it to influence what gets built first.

Workflows & Automation

Chain tools, commands, transformations, and agents into workflows you can version, schedule, and rerun against any target. BHW is a real Starlark dialect, so it feels like code because it is.

Datasets

Airtable-style tables for everything you discover: subdomains, hosts, ports, URLs, scan results. Custom schemas, full history, and triggers that fire as your data changes.

Self-hosted Runners

Register your own machines and invoke them from any workflow. Install proprietary scanners and private tooling, and your arsenal never leaves your infrastructure.

Modules

Package a proven sequence of steps into a reusable module with an explicit input and output contract, then compose it into any workflow. Write once, reuse everywhere.

bhlast: OOB Interactions

A self-hosted Burp Collaborator alternative. Capture DNS and HTTP callbacks, register custom records for SSRF, and serve exploits, and every interaction notifies you in real time.

Security Agents

Bring AI agents into your workflows to triage noisy results, investigate leads, and drive tools. You grant the context, tools, and providers explicitly. Nothing runs implicitly.

Artifacts & Storage

Keep command output, files, reports, screenshots, and binaries connected to the run that produced them. Blob storage sits right next to your projects and workflows.

Payload Management

Store payloads in reusable groups and template them with variables. Adapting wordlists and injection strings to each target takes seconds, not copy-paste sessions.

Notifications & Integrations

Scan findings, dataset triggers, and OOB interactions land in one inbox. Connect results to the tools and channels your team already lives in.

Historical Results

Every run is archived. Diff results across versions, spot changes on your targets, and never lose a finding to a rotated log or an overwritten file again.

Reusable Templates

Share and reuse workflows, modules, and proven recon chains. Start a new target from a template that already works instead of a blank file.

Reports & Export

Turn research output into reports instead of manually stitching results together. Query your datasets and hand over something that looks like it took a day, not a week.

From first probe to actionable data.

Discover feeds Transform, Transform feeds Store. From there your data fans out: alerts fire, AI agents pick up leads, and automated scans run in parallel, before everything merges into Analyze and investigate.

And it doesn't stop there. Results loop back into the system: analysis triggers agents, scans hand work to agents, and new leads restart discovery on the next target.

The BountyHub research loop Discover flows into Transform, which flows into Store. From Store three branches run in parallel: Get notified, AI Agent, and Automated scans. All three merge into Analyze and investigate. Feedback loops return from Transform to Discover, from AI Agent back to Transform, from Analyze and investigate to AI Agent, and from Analyze and investigate back to Discover. refine & re-runagent resultsinvestigate deepernew leadstriagefan outmergeDiscoverTransformStoreGet notifiedAI AgentAutomated scansAnalyze and investigate
Data flow Feedback loop

Get notified

Alerts fire the moment something changes: a new subdomain, an open port, a fresh OOB callback.

AI Agent

Agents triage noisy findings, chase promising leads, and hand structured results back into the pipeline.

Automated scans

Scans run on a schedule or as soon as new data lands, then feed both the agent and the analysis step.

The goal isn't another collection of security tools.

It's a system where discovery, execution, and data feed each other, and your best process runs again on every new target.

Datasets

Your findings, as data, not terminal scrollback.

Every subdomain, open port, URL, and scan result can land in a queryable table with a schema you define. Instead of re-parsing yesterday's output, you query what changed and let triggers fire the next step automatically.

  • Define custom schemasModel subdomains, ports, vulnerabilities, or anything else.
  • Full history of every changeSee when a row was inserted, updated, or soft-deleted.
  • Triggers fire on your dataA new row can kick off a workflow or notify your team.

Datasets are how BountyHub remembers. Workflows come and go; the data they produce stays useful.

datasets/domains trigger: row inserted
hoststatus
api.target.com200
dev.target.com403
staging.target.com200
vpn.target.com200
synced 06:00 UTC 4 rows · 2 changed

bhlast: OOB interactions

Never miss a blind callback.

bhlast is a self-hosted Burp Collaborator alternative built into BountyHub. It captures DNS and HTTP interactions, lets you register custom DNS records for SSRF testing, and serves exploits from its own file server. Every callback notifies you in real time.

  • Detect blind callbacksSSRF, blind XSS, and blind RCE: DNS and HTTP interactions land here the moment they fire.
  • Register custom DNS recordsPoint your targets at records you control for out-of-band testing.
  • Serve exploits from the file serverHost payloads and scripts next to the listener that catches them.

Provision a listener in one click and paste the callback domain straight into your payloads.

a1b2c3.oob.bountyhub.test live
14:02:11DNSssrf.a1b2c3.oob
14:02:13HTTPGET /?x=callback
14:03:47DNSrce.a1b2c3.oob
2 DNS · 1 HTTP notified in real time

Payload management

A payload arsenal you can template.

Store payloads in reusable groups and template them with variables. Adapting wordlists, injection strings, and exploit payloads to each target takes seconds, not another copy-paste session.

  • Group by purpose and targetKeep wordlists, injection strings, and exploits organized.
  • Template with variablesSwap in a target or callback without copy-paste sessions.
  • Reuse across every projectYour arsenal is available wherever you hunt.

One arsenal, every target: variables fill themselves in at injection time.

sqli-templates 4 payloads
' OR {{target}}' --
" UNION SELECT {{target}} --
<img src=x onerror=fetch("//{{oob}}")>
{{target}}/../../etc/passwd

variables

target=admin.example.comoob=a1b2c3.oob.bountyhub.test
rendered per target reused in 3 projects

Built for people who already have a process, and teams that need one.

Bug bounty hunters

Automate recon, keep every finding, and reuse a proven pipeline on every new program. Same workflow, new target, new findings, without rebuilding your setup each time.

Security researchers

Turn a methodology into a repeatable workflow, capture the data it produces, and get back to the part that needs a human brain: analysis and exploitation.

Pentesters & red teams

Build assessment workflows that run against the infrastructure you control. Keep client data, private tooling, and execution on your own runners.

Security teams

Continuously monitor your own attack surface. New subdomain, new open port, new callback: it lands in a dataset, triggers a workflow, and notifies the right people.

If your current workflow is a collection of shell commands, scripts, cron jobs, and notes, BountyHub gives that process structure. If you're responsible for an organization's assets, it gives you a way to watch them that doesn't depend on someone remembering to run a scan.

Help shape the next version of BountyHub.

BountyHub is entering private beta. We're looking for hackers, bug bounty hunters, security researchers, pentesters, and security teams who want to run real workflows on the platform and tell us what works, what breaks, and what should be built next.

This isn't a finished product. The beta is your chance to use BountyHub early, break things, shape the roadmap, and lock in founding pricing before the platform opens up.

Active beta testers get one year of Pro (normally $29.50/mo) free.

Join the beta

Simple pricing. Start free, scale when you need to.

Every plan includes the core platform: workflows, datasets, artifacts, and hosted runners. Upgrade to Pro when you want self-hosted runners and scheduled automation, pick Elite when you're hunting every day, or talk to us about monitoring your organization's assets at scale.

Free

$0forever

For bounty hunters who want to test BountyHub, or who hunt rarely and work a single target from time to time.

Join the beta
Best value

Pro

$29.50/ month

For bounty hunters who are serious about automation.

Join the beta

Elite

$49.50/ month

For full-time bounty hunters.

Join the beta

Custom

Customlet's talk

For security teams in companies, or hunters so deep into automation that they need a customized plan.

Contact us

Prices shown are beta pricing and will be locked in for active beta testers. Final limits for each plan will be confirmed together with the beta group.

Be there when BountyHub launches.

Sign up to join the private beta or just get notified when the new platform goes live. Tell us what you'd like to automate or monitor and we'll make sure the earliest builds fit the way you work.

Whether you want to test early or only hear about the launch, one form covers both.

Beta & launch signup

Form not loading? Open it in a new tab