Yogesh OjhaandClaude Opus 5 fe5bc8094c feat(bounty-hub): Bugcrowd, Intigriti and YesWeHack from the public feed ...

Bounty Hub was empty until someone pasted a HackerOne token. It now ships with
464 public programs and 6,889 scope assets from arkadiyt/bounty-targets-data
(MIT, republished every 30 minutes), so a fresh install is useful with no
credentials at all and the token becomes an upgrade rather than a prerequisite.

HackerOne is deliberately not read from the feed. The API gives us private
programs and richer scope, so the feed would be a downgrade — and a new
`source` column keeps that from happening by accident: an API row is
authoritative and the feed never overwrites one.

The three platforms do not agree on anything, so each gets its own entry in
shared/definitions/bounty_feed.py: the asset field is `target` on two of them
and `endpoint` on Intigriti; the type vocabularies are `website`/`network`
versus `url`/`wildcard`/`iprange` versus `web-application`/`mobile-application-ios`;
and only Intigriti and YesWeHack ship a handle, so Bugcrowd's is derived from
its engagement URL. All of it lands on the 17 asset types reNgine already has,
and target_for_scope needed no change to resolve 5,072 of them.

What the platforms do not report is not invented. Bugcrowd publishes no
submission state, so it stores `unknown` and the row shows no badge rather
than guessing "open". What they report and HackerOne does not — the actual
payout range — becomes a first-class field, a badge and a sort.

Provenance is visible rather than implied: every row names its platform, the
detail sheet says which source it came from and what that source can and
cannot contain, and Platform and Source are faceted filters.

The feed has its own schedule because it costs four small files rather than
640 requests: off, every 6 hours, daily or weekly, beside the HackerOne
interval in Settings. The change-detection layer needed nothing — it was
already platform-agnostic, so scope alerts work on all four platforms, and a
first feed load of 464 programs correctly announced none of them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZEi41ZDRWtwYDPFwoCVnu

2026-09-07 16:22:05 +05:30

..

ai

feat(reports): a document engine, not an export

2026-09-06 11:45:51 +05:30

api_key

fix(ui): the interface obeyed none of the style rules the AI prompt enforces

2026-09-06 18:26:29 +05:30

asset_query

feat(vulnerabilities): rank findings by exploitation, re-scored nightly without rescanning

2026-09-07 11:18:04 +05:30

orchestrator

fix(scan): headline counts summed the same rows twice, and missed some

2026-09-06 21:40:16 +05:30

__init__.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

activity_log.py

fix(scans): one NUL byte in a response no longer costs a 66-minute stage

2026-09-06 03:59:33 +05:30

bgp_summary.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

bounty_feed.py

feat(bounty-hub): Bugcrowd, Intigriti and YesWeHack from the public feed

2026-09-07 16:22:05 +05:30

bounty_programs.py

feat(bounty-hub): record what changed in a program and alert on it

2026-09-07 14:44:18 +05:30

celery_dispatch.py

feat(bounty-hub): Bugcrowd, Intigriti and YesWeHack from the public feed

2026-09-07 16:22:05 +05:30

endpoint_inventory.py

fix(scans): NUL reaches the inventories too, and the guard has to catch it

2026-09-06 07:48:59 +05:30

event_publisher.py

Refactor validation and DNS tools, implementation of onboarding wizard

2026-06-21 21:56:20 +05:30

exploitation.py

feat(vulnerabilities): rank findings by exploitation, re-scored nightly without rescanning

2026-09-07 11:18:04 +05:30

interest.py

feat(interest): a scan can say which twenty of five thousand hosts to open first

2026-09-06 19:30:04 +05:30

ip_asn.py

add ip-> asn, ip->cc, and global geo distribution map

2026-09-03 16:31:43 +05:30

ip_inventory.py

fix(scan): remove a deadlock window and stop failed facets zeroing a count

2026-09-04 03:27:09 +05:30

launch_plan.py

feat(scans): redesign the launch flow with engine-free custom scans

2026-09-05 08:16:43 +05:30

notification_sync.py

feat(notifications): a notification is an interrupt, the activity log is the ledger

2026-09-06 18:13:08 +05:30

notification.py

feat(notifications): a notification is an interrupt, the activity log is the ledger

2026-09-06 18:13:08 +05:30

notifier.py

fix(security): a Slack channel would post to any internal address

2026-09-07 00:38:42 +05:30

organization.py

fix(api): two names that reduce to the same slug returned 500

2026-09-07 07:04:45 +05:30

port_inventory.py

fix(scans): NUL reaches the inventories too, and the guard has to catch it

2026-09-06 07:48:59 +05:30

proxy_resolve.py

feat: implement scan scheduling functionality

2026-06-24 08:10:21 +05:30

recheck.py

feat: Introduce focused rescan functionality and related models

2026-09-06 08:31:29 +05:30

report_fonts.py

feat(reports): white-labelling, and a renderer that cannot be made to fetch

2026-09-06 12:53:18 +05:30

scan_factory.py

fix(security): every run that used a scan context stored its credential in the clear

2026-09-06 23:41:17 +05:30

scan_resolve.py

fix(engines): export could not be imported, and a masked edit destroyed the secret

2026-09-07 00:23:55 +05:30

scan_scope.py

feat: Introduce focused rescan functionality and related models

2026-09-06 08:31:29 +05:30

schedule_timing.py

feat: implement scan scheduling functionality

2026-06-24 08:10:21 +05:30

scope_filter.py

fix(contexts): one exclusion pattern could hang every scan using it

2026-09-07 00:35:01 +05:30

tag.py

fix(api): two names that reduce to the same slug returned 500

2026-09-07 07:04:45 +05:30

threat_intel.py

feat(vulnerabilities): rank findings by exploitation, re-scored nightly without rescanning

2026-09-07 11:18:04 +05:30

vuln_inventory.py

Add vuln nuclei module

2026-09-04 18:57:42 +05:30

vuln_templates.py

fix: a 379-byte YAML document took the API down for half a minute

2026-09-07 07:41:52 +05:30

vulnx.py

feat(vulnerabilities): rank findings by exploitation, re-scored nightly without rescanning

2026-09-07 11:18:04 +05:30

wordlists.py

feat(arsenal): wordlists are a library you upload to, not a path you type

2026-09-06 08:16:05 +05:30