BountyHub is being rebuilt
Stop running scripts.
Start running workflows.
BountyHub turns the repetitive parts of security research (recon, scanning, collecting, sorting, and remembering) into reusable workflows that run on infrastructure you control and keep their results as structured, queryable data.
Built for hackers who are tired of re-glueing the same shell commands on every target, and for teams who need to monitor their own attack surface continuously. Write it once, run it forever, and spend your time on the findings instead of the plumbing.
Built for Bug bounty hunters, Security researchers, Pentesters, Security teams.
Private beta coming soon
workflow( activities = [ activity( name = "discover", triggers = [trigger.cron("0 6 * * *")], steps = [ step.exec(command = ["subfinder", "-d", config.var("domain"), "-o", "subs.txt"]), step.transform( source = path.file("subs.txt").lines(), pipeline = transform.trim().lower().unique(), destination = path.file("subs-clean.txt"), ), step.update_dataset( table = "subdomains", source = path.file("subs-clean.txt").lines(), pipeline = transform.unique(), mapping = {"host": row.value}, mode = dataset.upsert(), ), ], ), activity( name = "triage", triggers = [trigger.on(discover.succeeded())], steps = [ step.agent( prompt = "Flag exposed admin panels on new hosts.", model = model("default"), provider = provider.key("anthropic/personal"), output = output.json(), ), ], ), ],)A real BHW workflow: scheduled discovery, typed transforms, dataset sync, and an AI triage step, written once and rerun on every target.
We're rebuilding BountyHub from the ground up.
The first version tested the idea. The next one will be the platform we actually want to hunt with.
Don't spend brain cycles organizing data and running tools. Let BountyHub do it. You analyze. You exploit. That is what hackers do.
Same workflow, new target, new findings!
One system for research, automation, and data.
Most hunting setups are a pile of shell commands, cron jobs, spreadsheets, and notes that only one person understands. BountyHub gives that process a home: workflows you can reuse, runners you control, and datasets that remember what you found.
Whether you're hunting a new program or watching your own attack surface around the clock, you describe the process once and let BountyHub run it.
Workflows
Build repeatable research.
Turn the commands, tools, and steps you already trust into reusable workflows. Version them, schedule them, and run them again on any target without rebuilding the process from scratch.
Execution
Run on your terms.
Execute on hosted runners or register your own machines as self-hosted runners. Keep proprietary scanners, internal networks, and sensitive targets inside your own infrastructure.
Datasets
Keep every result.
Recon output becomes structured, queryable data instead of a wall of terminal text. Track subdomains, hosts, ports, URLs, and scan results over time and see exactly what changed.
Agents
Automate the busywork.
Add AI agents to a workflow to triage results, chase leads, and operate tools, always within the limits and capabilities you explicitly grant.
Every capability you need to hunt and monitor at scale.
BountyHub is being rebuilt around capabilities that work together instead of existing as isolated features. Discovery feeds datasets, datasets trigger workflows, workflows call agents and runners, and everything that happens is captured as an artifact.
Not everything ships at once. Capabilities will land in stages during the beta. Join it to influence what gets built first.
Workflows & Automation
Chain tools, commands, transformations, and agents into workflows you can version, schedule, and rerun against any target. BHW is a real Starlark dialect, so it feels like code because it is.
Datasets
Airtable-style tables for everything you discover: subdomains, hosts, ports, URLs, scan results. Custom schemas, full history, and triggers that fire as your data changes.
Self-hosted Runners
Register your own machines and invoke them from any workflow. Install proprietary scanners and private tooling, and your arsenal never leaves your infrastructure.
Modules
Package a proven sequence of steps into a reusable module with an explicit input and output contract, then compose it into any workflow. Write once, reuse everywhere.
bhlast: OOB Interactions
A self-hosted Burp Collaborator alternative. Capture DNS and HTTP callbacks, register custom records for SSRF, and serve exploits, and every interaction notifies you in real time.
Security Agents
Bring AI agents into your workflows to triage noisy results, investigate leads, and drive tools. You grant the context, tools, and providers explicitly. Nothing runs implicitly.
Artifacts & Storage
Keep command output, files, reports, screenshots, and binaries connected to the run that produced them. Blob storage sits right next to your projects and workflows.
Payload Management
Store payloads in reusable groups and template them with variables. Adapting wordlists and injection strings to each target takes seconds, not copy-paste sessions.
Notifications & Integrations
Scan findings, dataset triggers, and OOB interactions land in one inbox. Connect results to the tools and channels your team already lives in.
Historical Results
Every run is archived. Diff results across versions, spot changes on your targets, and never lose a finding to a rotated log or an overwritten file again.
Reusable Templates
Share and reuse workflows, modules, and proven recon chains. Start a new target from a template that already works instead of a blank file.
Reports & Export
Turn research output into reports instead of manually stitching results together. Query your datasets and hand over something that looks like it took a day, not a week.
From first probe to actionable data.
Discover feeds Transform, Transform feeds Store. From there your data fans out: alerts fire, AI agents pick up leads, and automated scans run in parallel, before everything merges into Analyze and investigate.
And it doesn't stop there. Results loop back into the system: analysis triggers agents, scans hand work to agents, and new leads restart discovery on the next target.
Get notified
Alerts fire the moment something changes: a new subdomain, an open port, a fresh OOB callback.
AI Agent
Agents triage noisy findings, chase promising leads, and hand structured results back into the pipeline.
Automated scans
Scans run on a schedule or as soon as new data lands, then feed both the agent and the analysis step.
The goal isn't another collection of security tools.
It's a system where discovery, execution, and data feed each other, and your best process runs again on every new target.
Datasets
Your findings, as data, not terminal scrollback.
Every subdomain, open port, URL, and scan result can land in a queryable table with a schema you define. Instead of re-parsing yesterday's output, you query what changed and let triggers fire the next step automatically.
- Define custom schemasModel subdomains, ports, vulnerabilities, or anything else.
- Full history of every changeSee when a row was inserted, updated, or soft-deleted.
- Triggers fire on your dataA new row can kick off a workflow or notify your team.
Datasets are how BountyHub remembers. Workflows come and go; the data they produce stays useful.
| host | status | source |
|---|---|---|
| api.target.com | 200 | recon-run #41 |
| dev.target.com | 403 | recon-run #42 |
| staging.target.com | 200 | manual upload |
| vpn.target.com | 200 | recon-run #42 |
bhlast: OOB interactions
Never miss a blind callback.
bhlast is a self-hosted Burp Collaborator alternative built into BountyHub. It captures DNS and HTTP interactions, lets you register custom DNS records for SSRF testing, and serves exploits from its own file server. Every callback notifies you in real time.
- Detect blind callbacksSSRF, blind XSS, and blind RCE: DNS and HTTP interactions land here the moment they fire.
- Register custom DNS recordsPoint your targets at records you control for out-of-band testing.
- Serve exploits from the file serverHost payloads and scripts next to the listener that catches them.
Provision a listener in one click and paste the callback domain straight into your payloads.
Payload management
A payload arsenal you can template.
Store payloads in reusable groups and template them with variables. Adapting wordlists, injection strings, and exploit payloads to each target takes seconds, not another copy-paste session.
- Group by purpose and targetKeep wordlists, injection strings, and exploits organized.
- Template with variablesSwap in a target or callback without copy-paste sessions.
- Reuse across every projectYour arsenal is available wherever you hunt.
One arsenal, every target: variables fill themselves in at injection time.
variables
Built for people who already have a process, and teams that need one.
Bug bounty hunters
Automate recon, keep every finding, and reuse a proven pipeline on every new program. Same workflow, new target, new findings, without rebuilding your setup each time.
Security researchers
Turn a methodology into a repeatable workflow, capture the data it produces, and get back to the part that needs a human brain: analysis and exploitation.
Pentesters & red teams
Build assessment workflows that run against the infrastructure you control. Keep client data, private tooling, and execution on your own runners.
Security teams
Continuously monitor your own attack surface. New subdomain, new open port, new callback: it lands in a dataset, triggers a workflow, and notifies the right people.
If your current workflow is a collection of shell commands, scripts, cron jobs, and notes, BountyHub gives that process structure. If you're responsible for an organization's assets, it gives you a way to watch them that doesn't depend on someone remembering to run a scan.
Help shape the next version of BountyHub.
BountyHub is entering private beta. We're looking for hackers, bug bounty hunters, security researchers, pentesters, and security teams who want to run real workflows on the platform and tell us what works, what breaks, and what should be built next.
This isn't a finished product. The beta is your chance to use BountyHub early, break things, shape the roadmap, and lock in founding pricing before the platform opens up.
Active beta testers get one year of Pro (normally $29.50/mo) free.
Join the betaSimple pricing. Start free, scale when you need to.
Every plan includes the core platform: workflows, datasets, artifacts, and hosted runners. Upgrade to Pro when you want self-hosted runners and scheduled automation, pick Elite when you're hunting every day, or talk to us about monitoring your organization's assets at scale.
Free
$0forever
For bounty hunters who want to test BountyHub, or who hunt rarely and work a single target from time to time.
Join the betaCustom
Customlet's talk
For security teams in companies, or hunters so deep into automation that they need a customized plan.
Contact usPrices shown are beta pricing and will be locked in for active beta testers. Final limits for each plan will be confirmed together with the beta group.
Be there when BountyHub launches.
Sign up to join the private beta or just get notified when the new platform goes live. Tell us what you'd like to automate or monitor and we'll make sure the earliest builds fit the way you work.
Whether you want to test early or only hear about the launch, one form covers both.
Form not loading? Open it in a new tab