Your entire security research workflow. Your way.
BountyHub connects, automates, and continuously operates your security research workflows. Keep the tools and methodology you trust: workflows in Starlark, self-hosted runners on your own infrastructure, out-of-band interactions (bhlast), queryable datasets, templated payloads, and CVE monitoring.
Projects
Organize targets into projects. Reuse workflow templates and variables, so starting on a new target takes minutes, not hours.
Starlark workflows
Write security automation pipelines in BHW, a fully valid Starlark dialect, the same language family as Bazel. Version and reuse workflows across targets.
Self-hosted runners
Register runners on your own infrastructure and execute any command, including proprietary tools that never leave your machines.
Bhlast OOB server
A Burp Collaborator alternative built into BountyHub. Provision a listener in one click, capture out-of-band (OOB) interactions (DNS, HTTP, blind payload callbacks), and respond in real time.
Datasets
Airtable-style tables for your findings. Store subdomains, ports, and CVE scan results with full upload history and row-level triggers.
Payload management
Store payloads in reusable groups and template them with variables, so tailoring wordlists and injection payloads to each target is trivial.
CVE monitoring
Track known-exploited vulnerabilities that affect the software you run, with CVSS, EPSS, and CISA KEV context, and get notified when something relevant lands.
From first probe to
actionable data
Discover feeds Transform, Transform feeds Store. From there your data fans out: alerts fire, AI agents pick up leads, and automated scans run in parallel, before everything merges into Analyze and investigate. Results loop back in, so analysis triggers agents, scans hand work to agents, and new leads restart discovery on the next target.
Get notified
Alerts fire the moment something changes: a new subdomain, an open port, a fresh OOB callback.
AI Agent
Agents triage noisy findings, chase promising leads, and hand structured results back into the pipeline.
Automated scans
Scans run on a schedule or as soon as new data lands, then feed both the agent and the analysis step.
Automation should fit your workflow
Your best research comes from the methodology you've already built, so BountyHub doesn't replace your tools or force a fixed pipeline. It connects what you use, automates the repetitive parts, and keeps your research running continuously — with the pieces you need in one place: workflows as code, self-hosted runners, out-of-band interactions, payload management, datasets, and CVE monitoring.
Passionate about combining automation with security research to empower the bug bounty community
Manage multiple active/inactive projects
Each project maps to a target: a program, a domain, or an asset you're hunting on. Organize them your way: deactivate a target when you stop hunting and reactivate it later without losing workflow history, variables, or results.
- Configure variables and reuse workflow templates
- Get notified when scans detect diffs on your targets
- Reactivate targets without losing history
Acme Bug Bounty
Automated reconnaissance for acme.test
Build workflows in Starlark
BountyHub workflows are written in BHW, a fully valid Starlark dialect, just like Bazel. When you find yourself repeating the same recon steps, add scans to your workflow and version it. Every previous version is kept, so you can roll back or compare results at any time.
- Written in BHW, a valid Starlark dialect
- Version history and rollback for every workflow
- Test new scans alongside proven ones
subdomain-recon
Reuse recon phases as modules
When you repeat the same recon steps, package the phase once as a module with explicit inputs and outputs. Load it into any workflow with step.module, version it independently, and share it with other hunters instead of copying snippets.
- Package recon phases with explicit inputs and outputs
- Reuse everywhere via load() and step.module()
- Publish and share modules with other hunters
Host runners on your own infrastructure
Register self-hosted runners on your own machines and run any command you want. Install any tool, including proprietary scanners and private tooling, and invoke it directly from your workflows. Your tooling never leaves your infrastructure.
- Install any tool on your own machines
- Keep proprietary tooling private
- Trigger commands remotely from workflows
Self-hosted runners
Run tools on your own infrastructure
Capture out-of-band interactions
bhlast is a Burp Collaborator alternative built into BountyHub. Get notified the moment blind payloads fire (SSRF, blind XSS, blind RCE callbacks), register custom DNS records, and respond to interactions in real time, all from a server provisioned with one click.
- Detect blind payload callbacks (OOB)
- Register custom DNS records for your hunts
- Serve payloads and exploits from the file server
interactions
Build a payload arsenal and template it for reuse
Store your payloads on the platform and reuse them across projects. Template payloads with variables, so adapting wordlists, injection strings, and exploit payloads to a new target takes seconds.
- Group payloads by purpose
- Template payloads with variables
- Reuse across every project and target
XSS Payloads
"><script src=https://oast.acme.test></script>{{7*7}}"><img src=x onerror=alert(1)>Store findings in queryable datasets
Datasets are Airtable-style tables for everything you discover. Upload subdomain lists, open ports, CVE scan results, or any structured findings, and BountyHub keeps the history of every upload and lets you query the data whenever you need it. Row-level triggers fire on insert, update, and soft-delete, so your data reacts to new findings automatically.
- Define custom table schemas
- Full history of every upload and row
- Triggers on inserted, updated, and soft-deleted rows
| subdomain | status | source |
|---|---|---|
| api.target.com | 200 | recon-run #41 |
| dev.target.com | 403 | recon-run #42 |
| staging.target.com | 200 | manual upload |
Frequently asked questions
What is BountyHub?
BountyHub is a programmable platform for security research. You bring the tools and methodology you already use, and BountyHub connects, automates, and continuously operates your research workflows — with projects, versioned workflows in BHW, self-hosted runners, out-of-band (OOB) interactions (bhlast), queryable datasets, payload management, and CVE monitoring in one place.
Can I use my own tools and methodology?
Yes. BountyHub is built around your workflow, not a fixed pipeline. Run the scanners, scripts, and custom tooling you already trust, write your own steps and reusable modules, and execute on your own infrastructure through self-hosted runners.
What language are BountyHub workflows written in?
BountyHub workflows are written in BHW, a fully valid Starlark dialect, the same language family used by Bazel, extended with a domain-specific layer for building security automation and recon pipelines.
What is Bhlast?
Bhlast is a managed out-of-band (OOB) interaction server, hosted for you at bhlast.com. It captures DNS and HTTP(S) callbacks from blind payloads (SSRF, blind XSS, blind RCE), lets you register custom A, AAAA, and TXT DNS records, serves files for blind attacks, and notifies you the moment an interaction fires. Each server is provisioned with one click on a random subdomain under bhlast.com. Think of it as Burp Collaborator listening 24/7 with an extended feature set.
What are BountyHub Datasets?
Datasets are Airtable-style tables for your findings. Store historic subdomain records, open ports, CVE scan results, or any structured data. Every upload keeps its history, and row-level triggers fire on insert, update, and soft-delete so your data can react automatically.
Is BountyHub free?
BountyHub is currently in beta. See the pricing page for the latest plans and what is included.
Ready to run research your way?
Join security researchers building custom workflows with BountyHub. Bring your tools and methodology, and let BountyHub run the rest.