Browse documentation
Find opportunities with Pro discovery
Find changing programs with activity labels and sorting, search targets, compare rewards and competition, and build your next research shortlist.
On this page
The catalog covers 25 platforms, including HackZar. Enable Include VDPs for recognition-only programs. HackZar includes public scope and total report counts. Its catalog dates use the Created date published on each program page, with a conservative estimate when that date is unavailable. Select HackZar in Notification Rules to filter private alerts to that platform.
Open the program catalog
Go to the bbradar catalog while signed in with Pro.Enter a target fragment
Type at least three characters from a hostname, package, repository, contract, IP range, or another known target identity.Review the match context
Target-aware results show the program attached to the matching active target. Use a distinctive fragment when a broad word returns too many programs.Open the program
Review Overview for rewards and recent changes, then select Targets to explore scope.
- Program tier
- Elite
- What it highlights
- Very fresh, lightly reported programs with strong payout potential.
- Program tier
- Hot
- What it highlights
- Fresh programs with low visible competition and attractive rewards.
- Program tier
- Strong
- What it highlights
- Paid programs with a low public report count and solid potential, including older programs.
- Program tier
- Potential
- What it highlights
- Paid programs with a modest public report count that may be overlooked.
| Program tier | What it highlights |
|---|---|
| Elite | Very fresh, lightly reported programs with strong payout potential. |
| Hot | Fresh programs with low visible competition and attractive rewards. |
| Strong | Paid programs with a low public report count and solid potential, including older programs. |
| Potential | Paid programs with a modest public report count that may be overlooked. |
Use program tiers to build a research shortlist, then review the policy and program details before deciding what to investigate.
Find the Opportunity row
On the catalog, locate the Elite, Hot, Strong, and Potential chips above the program list.Select one or more tiers
Selected tiers work as alternatives, so choosing Elite and Hot shows programs in either tier.Combine with catalog filters
Narrow the results further with platform, tags, rewards, status, or search as needed.Clear the tier filter
Select the active chip again or use the clear action to return to the full catalog.
Tiers are discovery aids, not guarantees of payout, valid vulnerability classes, or low duplicate counts. Always read the program policy and validate eligibility before testing.
Use Pro activity labels to spot new scope, higher rewards and frequent updates while browsing. Red labels also flag scope reductions and lower rewards, so you can reassess a program before spending more time on it.
- Sort By
- Recently updated
- Use it to
- Catch up on the programs that changed most recently.
- Sort By
- Most active (30 days)
- Use it to
- Find programs that have been changing regularly.
- Sort By
- Largest scope change (7 days)
- Use it to
- Review the biggest recent scope updates first.
- Sort By
- Paid out (7 or 30 days)
- Use it to
- Order comparable tracked payout increases for the selected listing period, when available.
| Sort By | Use it to |
|---|---|
| Recently updated | Catch up on the programs that changed most recently. |
| Most active (30 days) | Find programs that have been changing regularly. |
| Largest scope change (7 days) | Review the biggest recent scope updates first. |
| Paid out (7 or 30 days) | Order comparable tracked payout increases for the selected listing period, when available. |
Combine these sorts with your platform, tag and reward filters. Pro listing rows show the available Paid 7d and Paid 30d values together. A dash means there is no usable value for that period; it is not zero.
Each program row shows up to four activity label icons, most useful first. Select one to see the numbers behind it and jump to the matching Activity view or program details. Open Activity for dedicated rankings and more periods.
Pro report-count badges also show dupe risk. The icon and color help you compare competition at a glance: green for Low, yellow for Medium and red for High. Hover over the count to read the risk level.
If a risk estimate is unavailable, the report count keeps its neutral appearance. You can also sort by report count to compare programs.
bbradar combines observations from supported program sources. Publication follows successful retrieval and verification; source availability, rate limits, and incomplete checks can delay changes. A discovery date is the time bbradar first observed a program, unless a separate upstream launch date is provided.
Opportunity and target scores use available freshness, rewards, target type, and public report activity. Factor breakdowns expose the contributing evidence. Model versions and evidence coverage in the API help distinguish a scoring change from a new source observation. A public report count may cover a platform-specific period; inspect its source label before comparing programs.
Missing evidence remains missing. Unknown dupe risk does not mean low competition, and a score does not estimate exploitability, expected earnings, or permission to test. Self-Hosted programs do not receive fabricated opportunity scores or platform history.
Confirmed paused programs remain visible for reference with retained scope and rewards. They are excluded from active opportunity results and their current bounty eligibility is disabled. Recorded lifecycle and catalog events can still appear in Activity. Always open the current official policy before selecting work.
Choose a program
Filter the catalog by the platform and asset categories relevant to your work. Open Example Program and inspect its status, reward description, and official policy link.Review an eligible target
With Pro, open Program Targets. An example row forapi.example.commight be in scope with a score of 74 and the label Strong Target. Check the factor breakdown and source observation, not just the score.Interpret an unknown signal
If dupe risk is Unknown, public evidence is insufficient. Keep that uncertainty in your shortlist instead of treating it as low competition.Save a relevant alert
Use the target’s alert shortcut, review the draft in Notification Rules, and select Save Rules. Keep only the streams and filters you want; a prefilled draft is not saved automatically.
The result is a short, evidence-based list to review against current program policies. An alert records a change; it does not authorize an interaction with an asset.
Future-dated contest programs remain publicly visible. Pro can also surface upcoming non-contest programs within the configured visibility window, giving you time to read policies and prepare research workflows before launch.