Monitor repository changes

When an in-scope target links to a supported repository and branch, later branch updates can appear in the Commits feed. Supported sources include GitHub repositories and Gists, GitLab, Bitbucket, Gitea, Forgejo, SourceHut, and selected HTTPS Git hosts. The first observation establishes the starting point and does not appear as a change.

1. 1

   Open Latest Targets

   Select the Commits tab.
2. 2

   Inspect the mapping

   Review the bounty program, source target, repository, branch, observation date, and before/after SHA.
3. 3

   Open the repository host

   Use the provider-specific compare link, or a commit link when no prior SHA is available, to inspect the change at its source.

Use the shared filters to narrow repository events by platform, tags, language, minimum target score, target opportunity label, or dupe risk. These target-level controls inspect the program target mapped to the repository event.

The browser refreshes the repository feed about once per minute only while the tab is active and the document is visible.

1. 1

   Open Notification Rules

   Repository alerts use the private Telegram rule, so connect Telegram first and open Notification Rules.
2. 2

   Enable Repository changes

   Turn on the explicit Repository changes stream. It starts disabled for new rules.
3. 3

   Choose the match mode

   Use Everything to receive every eligible repository event, or Filtered to apply the profile and opportunity controls below.
4. 4

   Add optional filters

   Filter by platform, parent-program opportunity, minimum target score, target opportunity label, dupe risk, scope, language, target type, reward, submission fee, program, or target pattern.
5. 5

   Select Save Rules

   Wait for the saved confirmation. Merely enabling the draft toggle does not change delivery.

A repository can be linked to more than one program target. An alert is included when at least one linked target matches your saved rule. Platform, reward, and parent-program opportunity filters still apply.

Repository events appear in the Commits feed first. Discord and opted-in Telegram notifications are grouped into hourly digests to reduce repeated alerts.

bbradar keeps the repository, branch or reference, before/after SHA, observation time, program links, and evidence quality needed to show an event. It does not retain code patches, diffs, source files, commit messages, changed paths, or addition/deletion details.

Accepted repository reference changes can also appear in the program’s History tab. That timeline retains the same limited reference information; code review happens on the repository provider.

A confirmed scope match has supporting evidence. When a comparison is incomplete and no scoped change can be confirmed, the update is labelled “scope impact unverified.” Historical events without recorded evidence quality remain unknown. A repository update does not establish permission to test.

Discord and Telegram therefore link you to the repository provider for inspection instead of embedding code-change content.

• Supported public repositories include GitHub and Gists, GitLab, Bitbucket, Gitea, Forgejo, SourceHut, and selected HTTPS Git hosts
• Active branch updates can appear in the Commits feed
• Tags and pinned commits are fixed references and do not produce later change alerts
• The first observation establishes a starting point without creating an alert
• Private or inaccessible repositories may not have change coverage

Coverage for self-managed repository hosts depends on whether that host is supported and publicly accessible.