# bbradar Docs — Programs, History, Alerts & API

> Find your next bug bounty program, spot activity with Pro, explore program History, and set up personal alerts and developer tools.

Source: [https://bbradar.io/docs](https://bbradar.io/docs)

<a id="free-and-pro"></a>

## [Choose your workflow](https://bbradar.io/docs.md#free-and-pro)

Use the public catalog to discover programs and compare rewards. Pro helps you spot changing programs, review their history, explore targets and follow the updates that matter to you.

| Task | Free access | With Pro |
| --- | --- | --- |
| Find programs | Browse platform listings, rewards, tags, program pages, and official policy links. | Compare available 7/30-day payouts, activity labels, opportunity signals, report counts and submission costs. |
| Plan audit contests | Compare public contest schedules, rewards and languages, and download available calendar events. | Inspect full program scope, target inventory and program intelligence. |
| Understand scope activity | See aggregate target counts and redacted examples of recent changes. | Read full target identities, eligibility, target changes, and supported repository events. |
| Review a program’s changes | Explore the program page and History preview. | Catch up in Overview, then open History to compare scope, rewards, policy and repository updates. |
| Find direct programs | Read the Self-Hosted guide and feature explanation. | Browse verified Self-Hosted paid programs and optional VDPs. |
| Receive alerts or use data in tools | Review the public setup guides and API reference. | Connect personal Telegram alerts, shared Discord access, the Pro API, and local MCP. |

[Explore the free catalogStart with programs and their official policies.](https://bbradar.io/)[Compare Pro plansReview features, billing options, and setup before subscribing.](https://bbradar.io/pro.md)

<a id="quick-start"></a>

## [Your first 10 minutes](https://bbradar.io/docs.md#quick-start)

Start with the account checklist. It takes you from active Pro access to a working alert channel and, if you need automation, a Pro API key.

1. ### Open your account

   Sign in with Google and confirm the Pro badge appears in [Account & Billing](https://bbradar.io/account).
2. ### Choose an alert channel

   Connect Telegram for personal filtered alerts, Discord for shared Pro server access, or both.
3. ### Review notification rules

   Select the events you want. Repository changes are opt-in, so enable that stream explicitly.
4. ### Create an API key if needed

   Use one key for the Pro API and the local `@bbradar/mcp` server.

Sanitized product view

Account & Billing

Set up your Pro workspace

Pro

Subscription

Pro active

Telegram

Connect

Notification rules

Review

API & MCP

Create key

Account setup checklist with Pro access active. Example data and credentials are fictional or redacted; named product controls match the interface.

[Follow the full setupActivate Pro and verify each part of your account.](https://bbradar.io/docs/getting-started.md)[Fix a setup issueWork through quick checks for every integration.](https://bbradar.io/docs/troubleshooting.md)

<a id="choose-a-path"></a>

## [Choose what to set up](https://bbradar.io/docs.md#choose-a-path)

[Audit contest calendarFind Web3 competitions, compare deadlines and export audit schedules.](https://bbradar.io/docs/contests.md)[Telegram alertsPrivate 1:1 alerts with your own filters.](https://bbradar.io/docs/notifications/telegram.md)[Notification rulesFilter by opportunity, target score, dupe risk, and saved exceptions.](https://bbradar.io/docs/notifications/rules.md)[MCP for AI toolsUse live Pro data from a compatible local MCP client.](https://bbradar.io/docs/mcp.md)[Pro APICall programs, opportunities, targets, target changes, and repository changes.](https://bbradar.io/docs/api.md)[Target intelligenceInvestigate and export active bounty scope.](https://bbradar.io/docs/pro/program-targets.md)[Program History and activitySpot changing programs and see what changed before choosing your next target.](https://bbradar.io/docs/pro/program-history.md)[Repository changesReview repository updates connected to program scope.](https://bbradar.io/docs/pro/repository-changes.md)[Self-Hosted catalogFind direct programs, compare rewards and scope, and configure alerts.](https://bbradar.io/docs/pro/self-hosted.md)[Frequently asked questionsGet quick answers about the catalog, Pro, alerts, integrations, and billing.](https://bbradar.io/docs/faq.md)

<a id="what-pro-unlocks"></a>

## [What Pro unlocks](https://bbradar.io/docs.md#what-pro-unlocks)

- Target-aware catalog search
- Verified Self-Hosted paid programs and VDPs
- Full active target identities
- Per-program History with before and after details
- Activity labels for scope, rewards and recent updates
- Activity comparisons for payouts, value, scope, rewards, reports, response and recorded events
- Sorting by recent updates, high activity and large scope changes
- Program and target opportunity signals
- Latest target-change feed
- Multi-provider repository-change feed
- Personal Telegram rules
- Discord Pro role
- Pro API and local MCP access

Public docs, private data

These guides are public so you can evaluate setup before subscribing. Pro data, credentials, notification preferences, and billing controls remain behind your authenticated account.

<a id="glossary"></a>

## [Understand the terms](https://bbradar.io/docs.md#glossary)

| Term | Meaning |
| --- | --- |
| Bug bounty and VDP | A paid program advertises a monetary reward, which may have no published amount. A vulnerability disclosure policy (VDP) has no confirmed monetary reward. |
| Self-Hosted | A security program run directly by an organization. Admission uses first-party program evidence; the linked current policy controls scope and permission. |
| Program opportunity | A comparative program tier based on available freshness, public report activity, rewards, and scope evidence. |
| Target Intelligence | A target score, label, factor breakdown, and dupe-risk context, when the source supports those signals. |
| Dupe risk | An estimate of visible crowding, not a measured probability of a duplicate report. Unknown means evidence is insufficient. |
| Paused program | A confirmed paused platform listing remains browsable. Retained scope and rewards describe previously published information; current bounty eligibility is disabled. |
| Latest changes | Recent target updates found across supported programs. |
| Program History | A timeline beside Targets on each program page, with recorded changes and earlier public updates where available. |
| Activity labels | Quick signs of recent updates, frequent changes, growing or shrinking scope, and rewards moving up or down. |
| Repository baseline | The starting point for following supported repository updates in the Commits feed. |

[How the signals are producedRead the evidence, freshness, and coverage limits behind the labels.](https://bbradar.io/docs/pro/discovery.md#methodology)

<a id="documentation-updates"></a>

## [Documentation updates](https://bbradar.io/docs.md#documentation-updates)

6 October 2026: compare available payouts and program changes in Activity. The [Program History and activity guide](https://bbradar.io/docs/pro/program-history.md) explains its views, payout ranges, period controls and links to program details.

13 September 2026: the contest calendar guide explains public access, filters, UTC deadlines, unconfirmed dates, calendar exports and reward types. The FAQs now cover audit competitions and schedule freshness.

8 September 2026: the API reference now describes paused programs, optional inventory queries, stable snapshots, expiry recovery, and current field types. The MCP guide confirms repository-feed support in version 0.2.3 and identifies remaining HTTP API capabilities.

These are documentation review notes, not program discovery dates or promises of source freshness. Check the authenticated capabilities response and the installed MCP guide for the contract your client uses.

---

# Get started with bbradar Pro | bbradar.io

> A practical setup checklist from sign-in and subscription through alerts, API access, and your first target search.

Source: [https://bbradar.io/docs/getting-started](https://bbradar.io/docs/getting-started)

<a id="before-you-start"></a>

## [Before you start](https://bbradar.io/docs/getting-started.md#before-you-start)

You need a Google account to sign in. bbradar currently supports Google as the login provider; Discord is an optional Pro integration, not a sign-in method.

- A supported browser with cookies enabled
- A Google account
- Telegram and/or Discord if you want alerts
- Node.js 20+ only if you plan to use MCP

<a id="activate-pro"></a>

## [Activate Pro](https://bbradar.io/docs/getting-started.md#activate-pro)

1. ### Open the Pro page

   Choose monthly or yearly billing on the [Pro page](https://bbradar.io/pro.md). Both plans include the same features.
2. ### Complete Stripe checkout

   Use the same bbradar session throughout checkout. You will return to bbradar after payment.
3. ### Confirm your access

   Open [Account & Billing](https://bbradar.io/account). The subscription card should show Pro as active.

Tip

If checkout completes but the badge has not updated, refresh Account & Billing once. If it remains inactive, use the troubleshooting guide before starting a second checkout.

<a id="setup-checklist"></a>

## [Complete the setup checklist](https://bbradar.io/docs/getting-started.md#setup-checklist)

Sanitized product view

Account & Billing

Set up your Pro workspace

Pro

Subscription

Pro active

Telegram

Connect

Notification rules

Review

API & MCP

Create key

Account setup checklist with Pro access active. Example data and credentials are fictional or redacted; named product controls match the interface.

| Task | Where | Done when |
| --- | --- | --- |
| Confirm Pro | Account & Billing | The subscription status is active. |
| Connect Telegram | Account & Billing | The Telegram card shows Active and your private chat. |
| Save alert rules | Notification Rules | Your chosen event streams and filters are saved. |
| Connect Discord | Account & Billing | Your Discord account and Pro role are shown. |
| Create API key | Account & Billing | A key prefix and active status are visible. |
| Use MCP | Your MCP client | The bbradar status tool reports connected Pro access. |

You can stop after any task. Telegram, Discord, the API, and MCP are independent; use only what fits your workflow.

<a id="confirm-access"></a>

## [Confirm everything works](https://bbradar.io/docs/getting-started.md#confirm-access)

1. ### Search a target

   From the catalog, enter at least three characters from a hostname or target identifier. Pro target matches appear with program results.
2. ### Explore a program

   Start with Overview for scope and recent activity, open Targets to investigate, then use History to compare changes.
3. ### Open Latest Targets

   Check the Added, Re-added, Updated, Removed, and Commits tabs.
4. ### Review integrations

   Return to Account & Billing and confirm every integration you enabled is active.

---

# Web3 audit contest calendar guide | bbradar.io

> Find smart contract audit competitions, compare Solidity and Rust contests, understand UTC deadlines and rewards, and export audit schedules to your calendar.

Source: [https://bbradar.io/docs/contests](https://bbradar.io/docs/contests)

<a id="find-contests"></a>

## [Find your next Web3 audit contest](https://bbradar.io/docs/contests.md#find-contests)

The public contest calendar brings together smart contract audit competitions and security challenges. Compare live and upcoming audits across platforms such as Code4rena, Sherlock, Cantina, CodeHawks, Immunefi and HackenProof, then choose work that fits your skills and schedule.

Browsing schedules, published rewards and languages is free, as are available calendar downloads. Full program scope, target inventory, scope exports and program intelligence require Pro.

[Open the audit contest calendarCompare smart contract competitions and security challenges.](https://bbradar.io/contests)[Explore program scope with ProUnderstand the target details and scope exports available with Pro.](https://bbradar.io/docs/pro/program-targets.md)

<a id="filters-and-views"></a>

## [Compare contests with filters and views](https://bbradar.io/docs/contests.md#filters-and-views)

Use the timeline to compare overlapping audit windows, or switch to the list for a compact view. Phones open the list by default. Select a contest to see its public preview and available calendar export. Your filters and chosen view are reflected in the URL so you can bookmark or share them.

| Control | Use it to |
| --- | --- |
| Search and platform | Find a project or narrow the calendar to a competition platform. |
| Language | Find Solidity, Rust, Move or other languages when the source publishes them. Missing language data does not mean a contest uses no programming language. |
| Type | Separate audit contests from security challenges. Ordinary ongoing bug bounties belong in the main catalog. |
| Status | Focus on live or upcoming competitions, or inspect ended and paused listings still retained in the catalog. All listed is not a complete historical archive. |
| Reward and sort | Filter by minimum published reward and compare deadlines, start dates, rewards or project names. |

The [contest tag](https://bbradar.io/tags/contest) also identifies contests and challenges in the main program catalog. It describes the program format; it is not a target technology or a statement about active scope.

<a id="dates-and-deadlines"></a>

## [Understand dates and unconfirmed deadlines](https://bbradar.io/docs/contests.md#dates-and-deadlines)

The calendar labels times in UTC. Exact timestamps support countdowns and timed calendar events. When a platform publishes only a calendar date, BBRadar shows that date without inventing an hour. Date-only deadlines use a dashed timeline bar and are excluded from timed downloads.

Dates to confirm

This section contains contests without a complete, consistent schedule verified by BBRadar. A source may omit a date, or a published change may still be waiting for a successful refresh. The official page can already show a deadline while BBRadar is catching up. Check that page for the current schedule.

Listings update after source data is retrieved, checked and saved. Platform outages and rate limits can delay updates. An unknown start is not proof that a contest is live; retained information on a paused listing does not mean submissions are open.

<a id="calendar-export"></a>

## [Add audit deadlines to your calendar](https://bbradar.io/docs/contests.md#calendar-export)

Choose Export calendar to download an ICS file for matching live and upcoming contests with exact start and end times. You can also download an individual event from its preview when its schedule supports export. Import the file into Google Calendar, Apple Calendar or Outlook; your calendar app displays UTC timestamps in your selected time zone.

Downloads are snapshots, not subscriptions. They do not automatically receive extensions or cancellations. Verify the latest schedule on the official contest page before planning your work or submitting a report.

<a id="coverage-and-rewards"></a>

## [Interpret platform coverage and rewards](https://bbradar.io/docs/contests.md#coverage-and-rewards)

Contest classification uses the platform’s published program format and available source data. Mixed platforms can host both fixed-window competitions and ongoing bug bounties; only contests and challenges appear here. Coverage depends on public listings and successful source checks, so the calendar cannot guarantee every competition or field is available.

Calendar amounts are labeled as published maximum rewards. Check the platform to see whether an amount represents a shared prize pool or a maximum individual award. A displayed amount is not a guaranteed payout; eligibility, severity, duplicate findings and reward allocation follow the platform’s rules.

Read the official contest scope and rules before choosing an audit. For calendar-specific answers, see the [audit contest calendar FAQ](https://bbradar.io/contests#faq).

---

# Bug Bounty FAQ: Programs, History & Pro | bbradar.io

> Answers about bug bounty programs, activity labels, sorting, program History, audit contests, Pro features, alerts and billing.

Source: [https://bbradar.io/docs/faq](https://bbradar.io/docs/faq)

<a id="questions"></a>

## Questions and answers

<a id="which-bug-bounty-platforms-are-supported-on-bbradar-io"></a>

### [Which bug bounty platforms are supported on BBRadar.io?](https://bbradar.io/docs/faq.md#which-bug-bounty-platforms-are-supported-on-bbradar-io)

We aggregate programs from major platforms including [HackerOne](https://bbradar.io/platforms/hackerone)[BugCrowd](https://bbradar.io/platforms/bugcrowd)[Intigriti](https://bbradar.io/platforms/intigriti)[Immunefi](https://bbradar.io/platforms/immunefi)[HackenProof](https://bbradar.io/platforms/hackenproof)[YesWeHack](https://bbradar.io/platforms/yeswehack)[Standoff365](https://bbradar.io/platforms/standoff365)[BI.ZONE](https://bbradar.io/platforms/bi-zone)[Code4rena](https://bbradar.io/platforms/code4rena)[Sherlock](https://bbradar.io/platforms/sherlock)[CodeHawks](https://bbradar.io/platforms/codehawks)[Cantina](https://bbradar.io/platforms/cantina)[Bugbase](https://bbradar.io/platforms/bugbase)[BugRap](https://bbradar.io/platforms/bugrap)[IssueHunt](https://bbradar.io/platforms/issuehunt)[Inspectiv](https://bbradar.io/platforms/inspectiv)[Bug Bounty Switzerland](https://bbradar.io/platforms/bug-bounty-switzerland)[AuditOne](https://bbradar.io/platforms/auditone)[CertiK](https://bbradar.io/platforms/certik)[Huntr](https://bbradar.io/platforms/huntr)[Remedy](https://bbradar.io/platforms/remedy)[Compass Security](https://bbradar.io/platforms/compass-security)[GObugfree](https://bbradar.io/platforms/gobugfree)[PatchDay](https://bbradar.io/platforms/patchday)[HackZar](https://bbradar.io/platforms/hackzar) We keep expanding as new platforms emerge.

<a id="where-can-i-compare-web3-audit-contests-and-competition-deadlines"></a>

### [Where can I compare Web3 audit contests and competition deadlines?](https://bbradar.io/docs/faq.md#where-can-i-compare-web3-audit-contests-and-competition-deadlines)

Open the free [Web3 audit contest calendar](https://bbradar.io/contests) to compare smart contract competitions and security challenges by platform, language, published reward and UTC schedule. Available ICS downloads are free. Full program scope, target inventory and program intelligence require Pro. The [contest calendar guide](https://bbradar.io/docs/contests.md) explains filters, dates and exports.

<a id="why-can-a-contest-deadline-differ-from-the-platform-s-page"></a>

### [Why can a contest deadline differ from the platform’s page?](https://bbradar.io/docs/faq.md#why-can-a-contest-deadline-differ-from-the-platform-s-page)

BBRadar updates a schedule after the source data has been retrieved, checked and saved. A recently announced or changed deadline can appear on the official page first. Dates to confirm means the calendar does not yet have a complete, consistent verified schedule; it does not prove the platform has no deadline. Date-only deadlines remain labeled without an invented closing time. Check the official contest page for the latest schedule.

<a id="what-information-is-available-for-hackzar-programs"></a>

### [What information is available for HackZar programs?](https://bbradar.io/docs/faq.md#what-information-is-available-for-hackzar-programs)

HackZar coverage includes public program profiles, reward ranges or recognition-only VDP status, scope targets, and total report counts where available. Enable Include VDPs to see recognition-only programs. Pro users can inspect targets and report counts and select HackZar in Notification Rules. Catalog dates use the Created date published on each program page. When that date is unavailable, a conservative estimate is used.

<a id="what-kinds-of-programs-do-you-list"></a>

### [What kinds of programs do you list?](https://bbradar.io/docs/faq.md#what-kinds-of-programs-do-you-list)

We list public programs across many categories and technologies, including:

[web](https://bbradar.io/tags/web)[mobile](https://bbradar.io/tags/mobile)[smart contract](https://bbradar.io/tags/smart-contract)[blockchain](https://bbradar.io/tags/blockchain)[contest](https://bbradar.io/tags/contest)[API](https://bbradar.io/tags/api)[cloud](https://bbradar.io/tags/cloud)[open source](https://bbradar.io/tags/open-source)[AI/ML](https://bbradar.io/tags/ai-ml)

<a id="how-often-are-programs-updated"></a>

### [How often are programs updated?](https://bbradar.io/docs/faq.md#how-often-are-programs-updated)

We check listings throughout the day. Update times vary by platform and depend on source availability, rate limits, and successful verification. Incomplete checks preserve existing listings.

<a id="how-do-i-submit-a-bug-to-a-program"></a>

### [How do I submit a bug to a program?](https://bbradar.io/docs/faq.md#how-do-i-submit-a-bug-to-a-program)

BBRadar is a tracker, not a submission platform. Open each program and submit your report directly on the program’s platform page. We link to the official program URL for every listing.

<a id="how-can-i-find-mobile-or-web3-bug-bounty-programs"></a>

### [How can I find mobile or web3 bug bounty programs?](https://bbradar.io/docs/faq.md#how-can-i-find-mobile-or-web3-bug-bounty-programs)

Use tags and filters: try the mobile tag for mobile targets, or the smart contract tag for web3. You can also use the search bar to filter by keywords.

<a id="are-all-programs-public"></a>

### [Are all programs public?](https://bbradar.io/docs/faq.md#are-all-programs-public)

BBRadar.io focuses on publicly available programs. Private or invite‑only programs are not listed.

<a id="how-can-i-sort-programs-to-find-my-next-opportunity"></a>

### [How can I sort programs to find my next opportunity?](https://bbradar.io/docs/faq.md#how-can-i-sort-programs-to-find-my-next-opportunity)

Sort by date or bounty to find new programs and compare rewards. Pro adds Recently updated, Most active (30 days), and Largest scope change (7 days), so you can put changing programs first. You can also sort by report count or submission cost with Pro.

<a id="what-do-the-program-activity-labels-mean"></a>

### [What do the program activity labels mean?](https://bbradar.io/docs/faq.md#what-do-the-program-activity-labels-mean)

Pro activity labels help you spot what deserves another look: expanded or reduced scope, higher or lower rewards, large scope changes, high activity, and recent updates. See them in program listings and on program details. Hover over a listing label for a quick explanation, or click it to open the program’s History.

<a id="how-do-i-read-the-report-count-badge"></a>

### [How do I read the report count badge?](https://bbradar.io/docs/faq.md#how-do-i-read-the-report-count-badge)

With Pro, the report count badge brings report volume and dupe risk together. Its color and icon show the dupe-risk level when available; hover over it to see the label. This helps you compare how crowded programs may be while browsing.

<a id="can-i-see-whether-a-program-charges-to-submit-a-report"></a>

### [Can I see whether a program charges to submit a report?](https://bbradar.io/docs/faq.md#can-i-see-whether-a-program-charges-to-submit-a-report)

Yes, with Pro. When a platform publishes this data, bbradar shows the program’s submission fee or deposit in program listings, program details, Latest Targets, and Pro API responses. The Free submission fee only toggle works together with the other listing and Latest Targets filters. Money is displayed with a $ prefix, while non-cash systems such as YesWeHack are shown in credits. If no submission cost is detected, the program is currently shown as Free. Only positive costs are added to program, lifecycle, and target-change notifications.

<a id="how-fresh-are-the-latest-programs"></a>

### [How fresh are the “Latest” programs?](https://bbradar.io/docs/faq.md#how-fresh-are-the-latest-programs)

We check sources throughout the day. A program appears after its source data has been retrieved, validated, and saved. Source outages, rate limits, and verification can delay publication.

<a id="what-does-a-paused-program-mean"></a>

### [What does a Paused program mean?](https://bbradar.io/docs/faq.md#what-does-a-paused-program-mean)

The platform has confirmed that the program is paused. Its listing remains available for reference, with previously published rewards and scope. Current bounty eligibility and active opportunity signals are disabled while paused. Check the official policy before choosing work; retained targets do not establish current permission to test.

<a id="how-are-self-hosted-programs-handled"></a>

### [How are Self-Hosted programs handled?](https://bbradar.io/docs/faq.md#how-are-self-hosted-programs-handled)

The Self-Hosted Pro catalog brings programs run directly by organizations into one searchable place. Compare their published rewards, scope and reporting routes, then use History to follow recorded changes. Always check the linked official policy before testing.

<a id="what-can-i-see-in-latest-targets-and-commits"></a>

### [What can I see in Latest Targets and Commits?](https://bbradar.io/docs/faq.md#what-can-i-see-in-latest-targets-and-commits)

Latest Targets helps you follow confirmed scope additions, re-additions, updates, and removals. The Commits tab shows supported repository branch updates connected to bounty targets. Use these feeds to spot activity, then open the linked official scope or repository provider before acting.

<a id="what-can-i-find-on-a-program-s-details-page"></a>

### [What can I find on a program’s details page?](https://bbradar.io/docs/faq.md#what-can-i-find-on-a-program-s-details-page)

Start with Overview for key program information, a scope summary, and the latest changes. Open Targets to explore the scope, or History to compare changes over time. Pro unlocks the full target list, change details, and activity labels.

<a id="where-can-i-review-a-program-s-change-history"></a>

### [Where can I review a program’s change history?](https://bbradar.io/docs/faq.md#where-can-i-review-a-program-s-change-history)

Open a program and choose **History**. With Pro, you can follow scope, rewards, policy, and repository updates in one timeline. Filter by date or change type, then open an update to see the details. [Explore Program History](https://bbradar.io/docs/pro/program-history.md).

<a id="can-i-see-what-a-program-update-actually-changed"></a>

### [Can I see what a program update actually changed?](https://bbradar.io/docs/faq.md#can-i-see-what-a-program-update-actually-changed)

Yes. Open an update in History to compare before and after details, see added or removed targets, and follow source links. It is a quick way to review a program before returning to your research.

<a id="can-i-focus-on-scope-or-reward-changes"></a>

### [Can I focus on scope or reward changes?](https://bbradar.io/docs/faq.md#can-i-focus-on-scope-or-reward-changes)

Yes. Use the History filters to choose Scope, Rewards, Rules & policy, Program, or Repositories. Combine a category with a date range to find the updates that matter to your work.

<a id="why-might-a-program-s-history-tab-be-empty"></a>

### [Why might a program’s History tab be empty?](https://bbradar.io/docs/faq.md#why-might-a-program-s-history-tab-be-empty)

Try All history and All events to see all available updates for that program.

<a id="does-every-history-event-trigger-a-notification"></a>

### [Does every History event trigger a notification?](https://bbradar.io/docs/faq.md#does-every-history-event-trigger-a-notification)

No. History lets you browse a program’s updates whenever you need them. Choose the alerts you want separately in Notification Rules.

<a id="what-are-opportunity-tiers-target-scores-and-dupe-risk"></a>

### [What are opportunity tiers, target scores, and dupe risk?](https://bbradar.io/docs/faq.md#what-are-opportunity-tiers-target-scores-and-dupe-risk)

They are Pro research signals that help you compare programs and targets. Program opportunity tiers highlight promising listings, while each target can include a score, label, factor breakdown, and dupe-risk context. Use them to prioritize research, not as a guarantee of payout, exploitability, or a duplicate-free report.

<a id="what-does-pro-include"></a>

### [What does Pro include?](https://bbradar.io/docs/faq.md#what-does-pro-include)

Pro helps you find programs, spot changes, and choose where to research next. It includes:

- Activity labels for scope changes, reward changes, and active programs.
- Sorting by recent updates, most active programs, and largest scope changes.
- [Program History](https://bbradar.io/docs/pro/program-history.md) with before and after details for scope, rewards, policy, and repository updates.
- Full program targets with eligibility details.
- Report counts with dupe-risk colors and icons for a quick comparison.
- Submission fees, cost sorting, and a free-submission filter.
- Program opportunity tiers and target intelligence to help build your shortlist.
- The verified Self-Hosted catalog for programs run directly by organizations.
- Program, target, and repository-change alerts through private Telegram messages and Pro Discord channels.
- Personal notification rules for the programs and changes you care about.
- Upcoming programs to plan your next research session.
- Pro API access and the `@bbradar/mcp` server for your own tools.

[See Pro plans](https://bbradar.io/pro.md)

<a id="how-do-repository-change-alerts-work"></a>

### [How do repository change alerts work?](https://bbradar.io/docs/faq.md#how-do-repository-change-alerts-work)

When a bounty target links to a supported repository and branch, later updates can appear in the Commits feed.

- The first observation establishes a starting point and does not create an alert.
- Later branch changes can appear under the [Commits tab](https://bbradar.io/latest-targets).
- Discord and opted-in Telegram notifications are grouped into hourly digests.
- Digest entries open the source provider's comparison, commit, or repository view.
- A confirmed scope match has supporting evidence. An unverified scope impact means the repository changed but the available comparison could not establish whether the scoped files changed.
- Historical events without recorded evidence quality are labelled as unknown.
- bbradar does not retain code, patches, filenames, or commit messages.

<a id="does-bbradar-pro-include-an-mcp-server"></a>

### [Does bbradar Pro include an MCP server?](https://bbradar.io/docs/faq.md#does-bbradar-pro-include-an-mcp-server)

Yes. Pro users can run the [@bbradar/mcp npm package](https://www.npmjs.com/package/@bbradar/mcp) as a local STDIO MCP server for compatible AI clients.

- Requires Node.js 20 or newer and a bbradar Pro API key.
- Most clients can run it with `npx -y @bbradar/mcp`.
- Add your key as `BBRADAR_API_KEY` in the MCP client environment.

<a id="is-every-pro-feature-available-through-the-api-or-mcp-server"></a>

### [Is every Pro feature available through the API or MCP server?](https://bbradar.io/docs/faq.md#is-every-pro-feature-available-through-the-api-or-mcp-server)

No. The Pro API covers platform and Self-Hosted program profiles, active target inventories, platform opportunity data, target intelligence, platform target changes, and minimal platform repository-change events. Self-Hosted responses explicitly mark unavailable signals instead of inventing opportunity scores, report counts, target-change feeds, submission costs, or repository changes. Repository events are available through the website, read-only Pro API, and supported notifications; MCP 0.2.3 also exposes get_repository_changes with compact program summaries and incremental polling. Snapshot parameters and some newer provenance fields remain HTTP API capabilities. The per-program History timeline currently requires a signed-in Pro browser session and is not included in API key endpoints or MCP tools.

<a id="where-do-i-manage-my-pro-api-key-and-endpoints"></a>

### [Where do I manage my Pro API key and endpoints?](https://bbradar.io/docs/faq.md#where-do-i-manage-my-pro-api-key-and-endpoints)

Go to [Account & Billing](https://bbradar.io/account) to create, regenerate, or delete your API key. Then open [Pro API reference](https://bbradar.io/docs/api.md) for endpoint details and cURL examples.

<a id="can-i-customize-which-pro-notifications-i-receive"></a>

### [Can I customize which Pro notifications I receive?](https://bbradar.io/docs/faq.md#can-i-customize-which-pro-notifications-i-receive)

Yes. Pro users can manage [notification rules](https://bbradar.io/account/notifications) for platform program, Self-Hosted paid/VDP, target, and repository-change streams plus program opportunity tiers, target scores and labels, dupe risk, platforms, scope tags, languages, bounty ranges, free or paid submission fees with an optional maximum, target changes, and specific programs or targets.

<a id="where-do-pro-notifications-appear"></a>

### [Where do Pro notifications appear?](https://bbradar.io/docs/faq.md#where-do-pro-notifications-appear)

Notifications can be delivered to your private Telegram DM and the Pro Discord channels after you connect your account. You can also browse [Latest Targets and Commits](https://bbradar.io/latest-targets) on the site.

<a id="how-do-i-enable-pro-notifications"></a>

### [How do I enable Pro notifications?](https://bbradar.io/docs/faq.md#how-do-i-enable-pro-notifications)

Subscribe to Pro, then use [Account & Billing](https://bbradar.io/account) to connect Telegram for private DM alerts and connect Discord for server channel access. Then open [Notification Rules](https://bbradar.io/account/notifications) to choose which alerts you want.

<a id="can-telegram-alerts-be-sent-to-groups-or-shared-channels"></a>

### [Can Telegram alerts be sent to groups or shared channels?](https://bbradar.io/docs/faq.md#can-telegram-alerts-be-sent-to-groups-or-shared-channels)

No. Telegram delivery is limited to private 1:1 DMs connected from the Pro user account, so alerts stay personal and tied to active Pro access.

<a id="how-do-pro-billing-and-cancellation-work"></a>

### [How do Pro billing and cancellation work?](https://bbradar.io/docs/faq.md#how-do-pro-billing-and-cancellation-work)

Monthly and yearly Pro plans include the same current features. Stripe handles checkout, invoices, and payment methods. Cancel from Account & Billing: paid access lasts through the paid period, while a past-due subscription ends immediately and automatic invoice retries stop. An unpaid invoice can remain open for separate review.

<a id="how-can-i-get-private-account-or-billing-support"></a>

### [How can I get private account or billing support?](https://bbradar.io/docs/faq.md#how-can-i-get-private-account-or-billing-support)

Email [info@bbradar.io](mailto:info@bbradar.io) for private account or billing questions. Include the page URL, approximate time, and visible status. Keep credentials, connection links, payment details, and session cookies out of the message. The [troubleshooting guide](https://bbradar.io/docs/troubleshooting.md#contact) lists useful support context.

<a id="how-do-i-request-a-platform-or-program-to-be-added"></a>

### [How do I request a platform or program to be added?](https://bbradar.io/docs/faq.md#how-do-i-request-a-platform-or-program-to-be-added)

Use the “Get Listed” page to contact us. We welcome requests from platforms and maintainers of public programs.

<a id="is-bbradar-io-affiliated-with-any-platform"></a>

### [Is BBRadar.io affiliated with any platform?](https://bbradar.io/docs/faq.md#is-bbradar-io-affiliated-with-any-platform)

No. We are an independent aggregator. Each program remains owned and managed by its respective platform or organization.

---

# Set up Pro notifications | bbradar.io

> Understand Telegram, Discord, event streams, opportunity and dupe-risk filtering, and which setup fits your workflow.

Source: [https://bbradar.io/docs/notifications](https://bbradar.io/docs/notifications)

<a id="channels"></a>

## [Choose a channel](https://bbradar.io/docs/notifications.md#channels)

Telegram: personal alerts

Private direct messages filtered by your own notification rules. Telegram is the best choice when you want selected platforms, program tiers, target scores or labels, dupe-risk levels, rewards, or change types.

Discord: shared Pro access

A Pro role in the bbradar community server with shared channels. Discord messages are not personalized by your Telegram notification rule.

| Capability | Telegram | Discord |
| --- | --- | --- |
| Delivery | Private 1:1 bot chat | Shared server channels |
| Personal filters | Yes | No |
| Connection | Single-use bot start link | Discord OAuth and server role |
| Best for | Focused, actionable alerts | Community and broad shared updates |

<a id="event-streams"></a>

## [Choose event streams](https://bbradar.io/docs/notifications.md#event-streams)

| Stream | What it means | Default |
| --- | --- | --- |
| New | A newly launched current program. | On |
| Upcoming | A future-dated program visible to Pro. | On |
| Older | An existing program discovered after its launch. | On |
| Suspended | A program became unavailable or inactive after stability checks. | On |
| Reactivated | A previously inactive program returned. | On |
| Target changes | Material additions, updates, re-additions, and confirmed removals. | On |
| Repository changes | Hourly digest of supported repository branch updates. | Off (opt in) |
| Self-Hosted bounties | A newly verified paid program operated directly by an organization. | On |
| Self-Hosted VDPs | A new disclosure policy with no monetary reward. | Off (opt in) |

Repository alerts are opt-in

The repository-change switch starts off. Enable it in Notification Rules if source-repository changes are part of your workflow.

<a id="recommended-setup"></a>

## [Recommended setup](https://bbradar.io/docs/notifications.md#recommended-setup)

1. ### Connect Telegram

   Use it as your personal, high-signal alert channel.
2. ### Start with filtered mode

   Select the platforms or scope types you actively research, then add opportunity signals and exclusions only where they improve the result.
3. ### Enable repository changes deliberately

   This stream can be busy. Turn it on only if branch activity is useful to you.
4. ### Choose Self-Hosted coverage

   Paid Self-Hosted programs start on; VDP notifications are separate and opt-in.
5. ### Connect Discord if you use the community

   The Discord role complements Telegram; it does not replace personal filters.

<a id="delivery-behavior"></a>

## [Delivery behavior](https://bbradar.io/docs/notifications.md#delivery-behavior)

Telegram and Discord alerts can arrive shortly after an event appears on bbradar. Temporary delivery failures are retried automatically. If you block the Telegram bot, reconnect it before expecting new private alerts.

Target changes and repository changes are separate streams. Enable each one you want, and use the Commits feed when you need to review repository activity directly in the browser.

[Connect TelegramLink and verify a private chat.](https://bbradar.io/docs/notifications/telegram.md)[Build your rulesControl streams and matching behavior.](https://bbradar.io/docs/notifications/rules.md)

---

# Connect Telegram alerts | bbradar.io

> Find the official @bbradario_bot account, link a private Telegram chat to bbradar Pro, verify delivery, and safely reconnect or disconnect it.

Source: [https://bbradar.io/docs/notifications/telegram](https://bbradar.io/docs/notifications/telegram)

<a id="requirements"></a>

## [Requirements](https://bbradar.io/docs/notifications/telegram.md#requirements)

- An active bbradar Pro subscription
- A Telegram account
- A browser signed in to the correct bbradar account
- Permission to open Telegram links from that browser

Note

Telegram delivery works only in a private 1:1 chat. Groups and channels are not supported, and one Telegram account cannot be linked to more than one bbradar account.

<a id="official-bot"></a>

## [Add the official bbradar bot](https://bbradar.io/docs/notifications/telegram.md#official-bot)

The official Telegram bot is **bbradar.io** with the exact username `@bbradario_bot`. Open it from the verified link below instead of relying on a display-name search.

1. ### Open the official bot profile

   Select the card below and allow your browser to open Telegram Desktop, the mobile app, or Telegram Web.
2. ### Check the username

   Before interacting, confirm the profile username is exactly `@bbradario_bot`.
3. ### Understand the two parts

   Opening or starting the bot creates the private chat. Linking that chat to your bbradar user requires the single-use connection link generated from Account & Billing in the next section.

[Open @bbradario_botOpen the official bbradar.io bot profile in Telegram.](https://t.me/bbradario_bot)

Check before you press Start

The bot never asks for your Google password, Stripe details, API key, or Telegram login code. A valid bbradar connection starts from Account & Billing and opens this same bot with a short-lived token.

<a id="connect"></a>

## [Connect Telegram](https://bbradar.io/docs/notifications/telegram.md#connect)

1. ### Open Account & Billing

   Use the signed-in bbradar account that should own the alerts, then find the **Telegram alerts** card.
2. ### Select Connect Telegram

   bbradar creates a single-use connection URL and opens `@bbradario_bot`. If the browser cannot open a new tab, it redirects the current tab to Telegram instead.
3. ### Verify the bot again

   Confirm the Telegram profile is `@bbradario_bot`. The account-generated link includes the private token needed to identify your bbradar user.
4. ### Press Start in Telegram

   Press **START** in the private chat. The bot consumes the token and should reply with **Telegram connected**.
5. ### Return to bbradar

   The account page checks the status automatically after a few seconds. Select **Refresh** if the card has not changed to Active.

[Open Account & BillingGenerate the required single-use Telegram link.](https://bbradar.io/account#telegram-alerts)[Check the official botConfirm that Telegram opened @bbradario_bot.](https://t.me/bbradario_bot)

Sanitized product view

Telegram alerts

Private direct messages

Pro

StatusNot connected

DeliveryPro alerts

Connect Telegram

bbradar.io

@bbradario_bot

Tap Start to connect your private alert chat.

START

Telegram connection flow from bbradar Account to a private bot chat. Example data and credentials are fictional or redacted; named product controls match the interface.

The link expires

The connection token normally expires after about 10 minutes. Creating another link invalidates the previous one, so always use the newest link.

<a id="verify"></a>

## [Verify the connection](https://bbradar.io/docs/notifications/telegram.md#verify)

1. ### Check the Telegram reply

   The private chat should contain the bot confirmation **Telegram connected**.
2. ### Check Account & Billing

   The Telegram card should show **Active**, your Telegram display name or username, and the linked date.
3. ### Open Notification Rules

   Choose Everything or Filtered, enable the event streams you need, leave **Telegram DM** enabled, and select **Save Rules**.
4. ### Confirm the save

   Look for the green **Rules saved** confirmation before leaving the page.

There is no separate test-notification button. A correctly linked Active status means the bot can use that chat for matching Pro events.

[Configure Notification RulesChoose streams and save the Telegram rule that should be delivered.](https://bbradar.io/account/notifications)

<a id="reconnect"></a>

## [Reconnect or disconnect](https://bbradar.io/docs/notifications/telegram.md#reconnect)

| Action | Use it when | Effect |
| --- | --- | --- |
| Reconnect | You changed Telegram accounts, blocked the bot, or need a fresh link. | Creates a new single-use token and replaces the linked chat after Start. |
| Refresh | You pressed Start but the account card still looks stale. | Reads the current integration status without changing it. |
| Disconnect | You no longer want Telegram delivery. | Unlinks the chat and stops or skips pending delivery for that integration. |

If Pro access becomes inactive, an existing integration may remain linked but delivery is paused until Pro is active again.

[Telegram troubleshootingResolve expired links, blocked chats, and account conflicts.](https://bbradar.io/docs/troubleshooting.md#telegram-issues)

---

# Build notification rules | bbradar.io

> Filter Telegram alerts by platform or Self-Hosted stream, opportunity, target score, dupe risk, scope, reward, and saved exceptions.

Source: [https://bbradar.io/docs/notifications/rules](https://bbradar.io/docs/notifications/rules)

<a id="rule-modes"></a>

## [Choose a rule mode](https://bbradar.io/docs/notifications/rules.md#rule-modes)

Every edit remains a draft until you save it. Use this sequence for a complete rule:

1. ### Open Notification Rules

   Open [Notification Rules](https://bbradar.io/account/notifications) from Account & Billing.
2. ### Choose Everything or Filtered

   Use Everything for broad delivery, or Filtered when platforms, rewards, submission fees, opportunity signals, and include or exclude rules should participate in matching.
3. ### Choose event streams

   Enable only the platform-program, lifecycle, target, repository, Self-Hosted bounty, or Self-Hosted VDP events you want. Repository changes and Self-Hosted VDPs are opt-in.
4. ### Keep Telegram DM enabled

   The rule controls private Telegram delivery. Discord channels are shared and do not use this page.
5. ### Review the Current rule preview

   Check the mode, streams, platforms, tags, languages, opportunity selections, target types, bounty, and submission-fee summary.
6. ### Select Save Rules

   Wait for the **Rules saved** confirmation. Navigating away before saving discards the draft.

The selected mode changes how the saved rule is evaluated:

| Mode | Behavior | Use it when |
| --- | --- | --- |
| Everything | All enabled event streams can be delivered. | You want broad coverage and do not need platform or target filters. |
| Filtered | An enabled event must also match your saved rule. | You want focused alerts based on your research interests. |

Note

Notification rules personalize Telegram only. Discord uses shared server channels.

[Open Notification RulesBuild, preview, and save your private Telegram rule.](https://bbradar.io/account/notifications)

<a id="streams"></a>

## [Select event streams](https://bbradar.io/docs/notifications/rules.md#streams)

Enable New, Upcoming, Older, Suspended, Reactivated, Target changes, Repository changes, Self-Hosted bounties, or Self-Hosted VDPs independently. Repository changes and Self-Hosted VDPs start disabled; verified paid Self-Hosted program alerts start enabled.

Sanitized product view

Notification Rules

Alert only when a saved rule matches

Pro

Rule mode

EverythingFiltered

Event streams

✓ New✓ Target changes✓ Repository changes

Filters

Programs: Elite or HotTarget score: 70+Target: Strong TargetDupe risk: LowPlatform: HackerOneExclude: *.staging.test

Save Rules

Filtered Telegram rule using program opportunity, target score, and dupe risk. Example data and credentials are fictional or redacted; named product controls match the interface.

For target changes, you can further select Added, Updated, Removed, and **New scope only**. The target-type filter can narrow alerts to domains, mobile apps, source-code targets, smart contracts, IP ranges, and other supported target categories.

<a id="filters"></a>

## [Add filters](https://bbradar.io/docs/notifications/rules.md#filters)

In Filtered mode, selected values inside one filter group are alternatives, while different filter groups must all match. For example, Elite or Hot programs can be combined with a minimum target score of 70 and Low dupe risk.

| Filter | What it matches |
| --- | --- |
| Platforms | Any of the 25 supported platform names, plus Self-Hosted. |
| Scope tags | Program and target tags such as web, mobile, API, source code, or smart contract. |
| Languages | Languages associated with the program or its repository targets. |
| Program opportunity | Elite, Hot, Strong, or Potential for the program attached to an alert. |
| Target opportunity | Elite Target, Strong Target, Potential Target, or Normal for each changed or repository-mapped target. |
| Minimum target score | A 0–100 threshold applied to each changed or repository-mapped target. |
| Dupe risk | Low dupe risk, Medium dupe risk, High dupe risk, or Unknown dupe risk for target and repository alerts. |
| Bounty range | Minimum and/or maximum advertised reward bounds. |
| Submission fee | Free only, paid only, or both, with an optional maximum fee or deposit. Missing platform cost data is treated as free. |
| Target changes | Added, updated, removed, and new-scope-only selections. |
| Target types | The target category shown by bbradar. |
| Program include/exclude | Exact saved programs that override or block other matching. |
| Target include/exclude | Identifier patterns used to override or block selected target matching. |

For a fee range or refundable deposit, the maximum possible amount is compared with your limit. USD and USDC use the displayed $ amount; credit-based platforms use their displayed credit amount.

<a id="opportunity-signals"></a>

## [Filter by opportunity and dupe risk](https://bbradar.io/docs/notifications/rules.md#opportunity-signals)

Program and target opportunity are separate signals. A program tier ranks the parent program; a target label and score rank one changed or repository-mapped target.

| Signal | Values | Applies to |
| --- | --- | --- |
| Program opportunity | Elite, Hot, Strong, Potential | Program alerts and the parent program on target or repository alerts. |
| Target opportunity label | Elite Target, Strong Target, Potential Target, Normal | Each target in Target changes and each mapped target in Repository changes. |
| Minimum target score | Any whole number from 0 to 100 | Each target in Target changes and each mapped target in Repository changes. |
| Dupe risk | Low, Medium, High, Unknown | Target and repository alerts. Higher risk means more visible crowding or duplicate pressure. |

| Target label | Score band |
| --- | --- |
| Elite Target | 85–100 |
| Strong Target | 70–84 |
| Potential Target | 50–69 |
| Normal | 0–49 |

Use target scores and dupe risk as comparative research aids, not predictions. **Unknown** means there is not enough public data for a reliable estimate; it does not mean low risk.

Grouped target alerts show only matching targets. Repository alerts are delivered when at least one linked program target matches the complete rule.

Missing signals do not match

Selecting a minimum score, target label, program tier, or dupe-risk value excludes an alert when the required signal is unavailable or does not match. Leave a group on All or Any if you do not want it to narrow delivery.

<a id="overrides"></a>

## [Understand include and exclude overrides](https://bbradar.io/docs/notifications/rules.md#overrides)

In filtered mode, exclusions always win. Includes are overrides, not allowlists:

- An excluded program never matches.
- An excluded target never matches.
- An included program bypasses matching filters, but not the enabled stream, selected target-change types, New scope only, or exclusions.
- An included target bypasses scope, language, target-type, minimum-score, target-opportunity, and dupe-risk filters.
- Platform, reward bounds, submission fee, parent-program opportunity, stream, target-change type, and New scope only still apply to an included target.

Pattern strategy

Start with broad platform and reward filters, then exclude noisy staging or documentation targets. Use includes only for exceptions you never want to miss.

<a id="examples"></a>

## [Example rules](https://bbradar.io/docs/notifications/rules.md#examples)

| Goal | Suggested rule |
| --- | --- |
| Fresh web scope | Filtered mode; Target changes on; Added and New scope only; target types Domain and URL; exclude known staging patterns. |
| High-value programs | Filtered mode; select Elite or Hot program opportunity; set a minimum bounty and an acceptable maximum submission fee; include one or two must-watch programs as explicit exceptions. |
| Fresh target opportunities | Target changes on; Added selected; minimum score 70; Elite Target or Strong Target; Low dupe risk. |
| Repository movement | Repository changes on; select relevant platforms plus a minimum score, target opportunity, or dupe risk; each mapped target must satisfy the selected target signals. |
| New paid Self-Hosted programs | Self-Hosted bounties on; Self-Hosted selected as the platform; add reward bounds only if you need them. |
| Self-Hosted disclosure policies | Self-Hosted VDPs on; Self-Hosted selected as the platform. VDPs have no confirmed monetary reward and are opt-in. |
| One program exception | Keep your normal filters and add that program to Included programs. |

After changing any field, select **Save Rules** and wait for the saved confirmation. Prefilling a rule from a program page does not save it automatically.

---

# Connect Discord and recover your Pro role | bbradar.io

> Join the bbradar Discord, link your account, and assign or recover the shared Pro role.

Source: [https://bbradar.io/docs/notifications/discord](https://bbradar.io/docs/notifications/discord)

<a id="discord-vs-telegram"></a>

## [Discord versus Telegram](https://bbradar.io/docs/notifications/discord.md#discord-vs-telegram)

Discord gives an eligible Pro user a role in the bbradar community server. It is shared access, not a personal notification inbox. Use Telegram when you need per-user filters.

[Personal Telegram alertsPrivate messages controlled by your rules.](https://bbradar.io/docs/notifications/telegram.md)[Notification rulesChoose the exact alerts you receive in Telegram.](https://bbradar.io/docs/notifications/rules.md)

<a id="connect-discord"></a>

## [Connect Discord](https://bbradar.io/docs/notifications/discord.md#connect-discord)

1. ### Join the bbradar Discord server

   Open the official invite below, select **Accept Invite**, and finish any Discord membership checks. Use the Discord account that should receive Pro access.
2. ### Open Account & Billing

   Return to bbradar with Pro active and find the **Discord access** card.
3. ### Select Connect Discord

   bbradar redirects you to Discord OAuth. Check the signed-in Discord identity, then select **Authorize**.
4. ### Return to bbradar

   After the callback, the Discord card should show the linked username and **Pro role assigned**.
5. ### Confirm access in Discord

   Open the bbradar server with the linked account and verify that the Pro channels are visible.

[Join the bbradar DiscordOpen the official community invite before linking your Pro role.](https://discord.gg/4DAm4Gg8JC)

Sanitized product view

Discord Pro role

Shared server access

ROLE ACTIVE

Discord accountresearcher_demo

Serverbbradar.io

RolePro

Reconnect Discord

Discord connection card showing an assigned Pro role. Example data and credentials are fictional or redacted; named product controls match the interface.

<a id="recover-role"></a>

## [Recover your role](https://bbradar.io/docs/notifications/discord.md#recover-role)

1. ### Check server membership

   Confirm that the linked Discord account is still a member of the bbradar server.
2. ### Open the Discord access card

   In Account & Billing, verify the displayed username is the account you are checking in Discord.
3. ### Select Reconnect Discord

   bbradar retries the current role assignment. Return to Discord and check the Pro channels again.
4. ### Replace the account if needed

   Use **Connect a different Discord account**, sign in to the intended Discord identity, and authorize the flow.

There is no separate self-service disconnect control. Contact support if the saved Discord connection cannot be replaced.

<a id="role-lifecycle"></a>

## [Keep your Pro role](https://bbradar.io/docs/notifications/discord.md#role-lifecycle)

Your Discord Pro role remains available while your bbradar Pro access is active and can be removed after Pro access ends.

Security

Never send a Discord token or authorization callback URL to support.

---

# Connect bbradar to AI tools with MCP | bbradar.io

> Install the bbradar MCP server and use program opportunities, target intelligence, and Pro data in a compatible AI client.

Source: [https://bbradar.io/docs/mcp](https://bbradar.io/docs/mcp)

<a id="prerequisites"></a>

## [Prerequisites](https://bbradar.io/docs/mcp.md#prerequisites)

- Active bbradar Pro access
- A bbradar Pro API key
- Node.js 20 or newer
- An MCP client that supports local STDIO servers

The `@bbradar/mcp` package runs locally on your computer. It talks to the bbradar Pro API using your key and exposes structured tools to your MCP client.

These capabilities were checked against published version `0.2.3`. The installation commands select the current npm release; use `get_mcp_status` and `get_bbradar_guide` to check the version and tools installed in your client.

Check Node.js and run once

```
node --version
npx -y @bbradar/mcp
```

[Open @bbradar/mcp on npmReview the published package, current tools, and client examples.](https://www.npmjs.com/package/@bbradar/mcp)

<a id="create-key"></a>

## [Create an API key](https://bbradar.io/docs/mcp.md#create-key)

1. ### Open Account & Billing

   Find the Pro API key card.
2. ### Create the key

   Select **Create API key**. Each account has one active personal key.
3. ### Copy it immediately

   The complete `bbr_live` secret is shown only once. Store it in your MCP client environment.

Sanitized product view

Your API key is ready

This secret is shown once.

bbr_live_demo_••••••••••••••••••••

Store it in your client environment, then close this dialog.

One-time API key dialog with the secret redacted. Example data and credentials are fictional or redacted; named product controls match the interface.

<a id="install"></a>

## [Install in your MCP client](https://bbradar.io/docs/mcp.md#install)

1. ### Choose the matching client section

   Use the exact command or configuration shape for Codex, Claude Code, OpenCode, or your generic MCP client.
2. ### Insert your API key

   Replace `YOUR_BBRADAR_API_KEY` locally. Do not paste the key into a prompt or share the finished configuration.
3. ### Add or save the server

   Run the CLI command, or save the JSON in the configuration file used by your client.
4. ### Restart the client

   Most clients load local STDIO server configuration only during startup.

### Codex CLI

Terminal

```
codex mcp add bbradar_io --env BBRADAR_API_KEY="YOUR_BBRADAR_API_KEY" -- npx -y @bbradar/mcp
```

### Claude Code

Terminal

```
claude mcp add bbradar_io --scope user --env BBRADAR_API_KEY="YOUR_BBRADAR_API_KEY" -- npx -y @bbradar/mcp
```

### OpenCode

Add the local server to your OpenCode configuration:

opencode.json

```
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bbradar.io": {
      "type": "local",
      "command": ["npx", "-y", "@bbradar/mcp"],
      "enabled": true,
      "timeout": 30000,
      "environment": {
        "BBRADAR_API_KEY": "YOUR_BBRADAR_API_KEY"
      }
    }
  }
}
```

### Generic JSON configuration

MCP client configuration

```
{
  "mcpServers": {
    "bbradar.io": {
      "command": "npx",
      "args": ["-y", "@bbradar/mcp"],
      "env": {
        "BBRADAR_API_KEY": "YOUR_BBRADAR_API_KEY"
      }
    }
  }
}
```

Windows clients

If a native Windows client cannot launch `npx` directly, set the command to `cmd` and begin the arguments with `/c`, `npx`. For Claude Code, place `cmd /c` immediately before `npx` in the command above.

<a id="verify-mcp"></a>

## [Verify the connection](https://bbradar.io/docs/mcp.md#verify-mcp)

1. ### Restart or reload your MCP client

   Clients normally read local server configuration at startup.
2. ### Run get_mcp_status

   Confirm the server is connected, authentication is valid, and Pro access is active.
3. ### Run get_bbradar_guide

   Use the built-in guide to discover the available bbradar tools and their parameters.
4. ### Try a narrow query

   Ask for a small program or opportunity result before requesting large target or change feeds.

Sanitized product view

MCP client

$ get_mcp_status

server bbradar_io

status connected

access pro

tools programs, opportunities, targets, target_changes, repository_changes

Authentication verified

MCP server status after a successful bbradar connection. Example data and credentials are fictional or redacted; named product controls match the interface.

<a id="mcp-capabilities"></a>

## [Available data and limitations](https://bbradar.io/docs/mcp.md#mcp-capabilities)

| Data | Available through MCP | Notes |
| --- | --- | --- |
| Programs | Yes | Paginated platform and Self-Hosted program data with server-side name, handle, platform, policy-host, and target search. |
| Self-Hosted program profiles | Yes | Exact program lookup, rewards, policy and reporting routes, structured scope, and capability markers. |
| Opportunity tiers | Yes | Elite, Hot, Strong, and Potential programs with the score factors and reason returned by the API. |
| Program targets | Yes | Active target identities for platform and Self-Hosted programs. Target scoring and dupe-risk fields appear only when their source signals exist. |
| Target changes | Yes | Page browsing plus bounded incremental cursor polling with the same target-intelligence fields. |
| Repository changes | Yes (MCP 0.2.3) | get_repository_changes provides a bounded platform feed, compact program summaries, and incremental cursors. Repository quality fields are not all projected by this package version. |
| Program History | Where advertised | Read one program’s timeline or a selected change’s details through the matching History tools. |
| Activity and payouts | Where advertised | Discover available periods and rankings, read payout/report/response facts, or combine multiple signals in one server-paginated catalog query. |

Run `get_bbradar_guide` in your client for the installed package’s current tool parameters. MCP uses the Pro API and preserves `data_capabilities`, so clients can distinguish an unsupported signal from a real zero or empty result.

For Activity, use `get_activity_capabilities` to discover supported period, basis, precision, sort and direction combinations. The matching tools preserve the website’s calculations, source definitions and unavailable values. Use get_activity_value for the fixed-definition Value map and label-specific shortlists; get_program_payouts includes the same signal explanations shown on program pages. Request explicit windows such as the last 30 days; do not treat that as a calendar month or silently substitute a longer period.

Check installed capabilities

Available tools depend on the installed MCP package and API deployment. Use the [HTTP API reference](https://bbradar.io/docs/api.md) for route contracts and snapshot paging. Activity event detail uses the originating page’s snapshot; combined queries keep their filters unchanged between pages.

<a id="key-safety"></a>

## [Keep your key safe](https://bbradar.io/docs/mcp.md#key-safety)

- Put the key in the MCP client environment, not prompts
- Do not commit client configuration containing the secret
- Do not paste the key into chat or support messages
- Regenerate immediately if the secret may have leaked

Security

Selecting **Regenerate** invalidates the previous secret immediately. Update every API script and MCP client that used it. Selecting **Delete** stops all API and MCP access until you create another key.

---

# Pro API Reference — Endpoints, Examples & MCP | bbradar.io

> Complete reference for authentication, platform and Self-Hosted data, MCP-efficient polling, endpoints, examples, responses, limits, and errors.

Source: [https://bbradar.io/docs/api](https://bbradar.io/docs/api)

<a id="authentication"></a>

## Authentication

v1

Every Pro API request uses your personal API key as a Bearer token. Keep the key in a server-side secret or MCP client environment—never in browser JavaScript or a public repository.

Base URL

`https://bbradar.io/api`

Request header

`Authorization: Bearer YOUR_PRO_API_KEY`

The complete secret is displayed once. Regenerating it immediately invalidates the previous key.

[Manage API key](https://bbradar.io/account#api-key)

<a id="first-request"></a>

## Make your first request

Start with capabilities so automation can negotiate the current contract without scanning catalog data.

```
curl -sS "https://bbradar.io/api/v1/pro/capabilities" -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Invalid query or path parameters return `400` with a detail message and an errors array. Authentication failures return `401`; missing programs return `404`.

<a id="catalog-status"></a>

## Catalog status and field types

Program lists and exact detail include confirmed paused platform programs. Read `program_status` and `is_active` together: a paused program retains `is_active: false`. Its scope and reward information describe the last published state, and bounty eligibility is disabled. Global target search, opportunity lists, and change feeds require active programs. Exact target reads may return retained scope with the parent status attached; bulk exports include paused scope only with explicit program IDs and `include_ineligible=true`.

| Field | Type and meaning |
| --- | --- |
| program_status / is_active | String status and boolean lifecycle state. Paused platform metadata remains visible; paused does not mean active. |
| star_rating | Integer from 1 to 5, or null when the vote threshold is not met. |
| review_signal / weighted_sentiment | Numbers derived from recorded vote totals; these are not text review labels. |
| report_count | Number or null. Check report_count_source and report_count_label when present because platform reporting windows differ. |
| submission_cost | Object or null. Missing platform observations currently default to amount 0 with source missing_defaults_free; free-platform policy uses platform_policy. Neither default is a newly observed fee. |
| data_capabilities | Boolean markers for available catalog signals. A false capability means unsupported, not a measured zero. |

Examples use fictional programs and reserved example domains. Response examples are abbreviated; preserve unknown fields for forward compatibility. Identifiers use the exact `platform:handle` returned by the API, and handles can contain slashes.

<a id="data-fields"></a>

## Opportunity and Target Intelligence

Pro responses include structured signals that clients can display directly. Each field below has one job.

### Program opportunity

`opportunity_tag`Tier, score, factors, and the reason a program is highlighted.

`submission_cost`Amount, optional maximum, unit, fee or deposit type, source, and observation time.

### Target score

`targetOpportunityScore``targetOpportunityLabel`A 0–100 score and its fixed Elite, Strong, Potential, or Normal label.

`targetScoreBreakdown``whyThisTarget`The underlying factors and a concise human-readable explanation.

### Competition risk

`competitionRisk``competitionRiskReason`Low, Medium, High, or Unknown, plus the evidence behind that classification.

Higher means more crowded or duplicate-prone. Unknown means insufficient public data—not Low risk.

### Self-Hosted capability markers

Self-Hosted IDs use `Self-Hosted:program-slug`. Their `data_capabilities` object is authoritative: target inventory is returned, while report counts, opportunity scores, target-change history, submission costs, and repository changes are not invented when no source exists.

Target labels use fixed score bands: Elite Target is 85–100, Strong Target is 70–84, Potential Target is 50–69, and Normal is 0–49. Out-of-scope or explicitly ineligible targets do not receive Target Intelligence.

Use scoring model versions and evidence coverage in the returned breakdowns to interpret the available factors. Scores and competition labels are comparative estimates, not measured duplicate probabilities. Repository events include a `comparison` object describing evidence completeness, method, reason, matcher version, ancestry, and provider commit count when known. Target associations expose `match_quality` and `match_reason`; program summaries preserve `match_qualities`, including when `include_targets=false`. Unknown evidence remains unknown.

<a id="mcp-polling"></a>

## Efficient MCP polling

Use `after_id` for incremental feeds. Results are oldest-first; start with `after_id=0`, persist `meta.next_after_id` after processing the response, and send it with the next request. This skips total-count and facet work.

Target changes

```
curl -sS -G "https://bbradar.io/api/v1/pro/targets/changes" \
  --data-urlencode "after_id=48101" \
  --data-urlencode "page_size=50" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Repository summaries

```
curl -sS -G "https://bbradar.io/api/v1/pro/repositories/changes" \
  --data-urlencode "after_id=17041" \
  --data-urlencode "include_targets=false" \
  --data-urlencode "page_size=50" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Cursor mode requires `page=1`. Repository target-intelligence filters are page-only; indexed search, platform, tag, submission-cost, and visibility filters can be used with the cursor.

<a id="stable-pagination"></a>

## Stable pages and recovery

Ordinary page requests read live data. For stable pagination, send `snapshot=start` on page 1 of programs, target search, target changes, or repository changes. Reuse `meta.snapshot` on later pages with the same filters and account. Page size may change. Use `meta.snapshot_expires_at` and `meta.as_of` to track expiry and the observation cutoff.

Snapshot response metadata (illustrative)

```
{
  "meta": {
    "snapshot": "EXAMPLE_TOKEN_RETURNED_BY_THE_API",
    "snapshot_expires_at": "2026-09-07T12:05:00Z",
    "as_of": "2026-09-07T12:00:00Z",
    "consistency": "snapshot",
    "page": 1,
    "page_size": 50,
    "has_more": true
  }
}
```

Snapshots last five minutes and hold at most 5,000 rows or 4 MiB. At most three snapshots per account and sixteen globally can be active. Narrow filters after 413; honor Retry-After when capacity returns 429. A 410 requires a new snapshot on page 1. If a snapshot includes a change cursor, finish every snapshot page before advancing the cursor.

Change feeds contain retained observations, and target changes represent the latest material state per target. They are not an immutable event journal. Reconcile current inventory periodically and after disconnection; a cursor older than retained history returns 410 and requires resynchronization. Exports use a consistent read, return at most 500 targets, and report truncation in metadata.

MCP 0.2.3 exposes both change feeds and cursor polling. Its published tool schemas do not expose snapshot tokens; use the HTTP API when stable pages are required.

<a id="activity-signals"></a>

## Activity, payouts and derived signals

Read available views before requesting a ranking. These Pro routes use the same frozen calculations and explanations as the website. Keep nulls, bounds, source definitions and observation times intact. An observed increase does not identify an individual payment.

| GET route | Contract |
| --- | --- |
| /api/v1/pro/activity/capabilities | Available tabs, period/basis/precision combinations, sorts, directions and label filters. |
| /api/v1/pro/activity/rankings | One sortable page (limit 1–100) with meta.as_of, snapshot_id and next_cursor. Tabs: payouts, value, scope, rewards, updates, reports, response, status, all_changes. |
| /api/v1/pro/payouts/programs/{program_id} | Exact program facts, signals, labels, label_details and same-platform value_points. Handles may contain slashes. |
| /api/v1/pro/activity/events/{change_id} | Lazy before/after details; supply the originating ranking’s meta.snapshot_id as snapshot. |

Value uses lifetime payout per processed report and 90-day received volume, so omit period. It returns all matching map points (up to 5,000) separately from paginated rows. Platform percentiles are frozen before filters; label-specific shortlists may include programs without both map inputs. Use the advertised sort and direction and keep every filter unchanged with the cursor. A 410 requires a fresh query; a 422 means the requested view is unavailable or the selection must be narrowed. Private responses are no-store.

Example Value query

```
curl -sS "https://bbradar.io/api/v1/pro/activity/rankings?tab=value&labels=pays_near_top_reward&sort=realization&direction=desc&limit=25" -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

<a id="endpoints"></a>

## Endpoint reference

Each endpoint includes its purpose, parameters, cURL request, and an abbreviated response. Use the endpoint links to jump directly to a section.

<a id="endpoint-capabilities"></a>

### [GET`/api/v1/pro/capabilities`](https://bbradar.io/docs/api.md#endpoint-capabilities)

Negotiate the authenticated v1 contract, supported catalogs, route methods, filters, and hard result limits without querying catalog data.

Parameters and examples

Parameters

No query parameters

Bearer authentication is required

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/capabilities" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "api_version": "v1",
  "contract_version": "2026-09-06",
  "behavior": {
    "read_only": true,
    "private_cache_control": "no-store",
    "catalogs": ["platform", "self_hosted"],
    "scoring_version": 3,
    "submission_cost_policy_version": 1,
    "stable_snapshots": {
      "endpoints": ["programs", "target_search", "target_changes", "repository_changes"],
      "parameter": "snapshot", "start_value": "start", "ttl_seconds": 300,
      "max_rows": 5000, "max_bytes": 4194304, "expired_status": 410
    },
    "change_feed_contract": "latest retained state; reconcile inventory periodically; not an immutable event journal"
  },
  "endpoints": {
    "programs": { "method": "GET", "max_page_size": 100, "self_hosted": true },
    "program_detail": { "method": "GET", "self_hosted": true, "path_handles_may_contain_slashes": true },
    "program_targets": { "method": "GET", "max_page_size": 500, "self_hosted": true },
    "target_search": { "method": "GET", "max_page_size": 500, "self_hosted": true },
    "target_export": { "method": "POST", "max_targets": 500, "max_program_ids": 50, "max_request_body_bytes": 65536 },
    "target_changes": { "method": "GET", "max_page_size": 100, "self_hosted": false, "incremental_cursor": { "parameter": "after_id", "order": "ascending", "max_scan_rows": 2000, "returns_facets": false } },
    "repository_changes": { "method": "GET", "max_page_size": 100, "self_hosted": false, "includes_code_or_diff_content": false, "returns_facets": false, "max_association_rows_per_request": 5000, "incremental_cursor": { "parameter": "after_id", "order": "ascending", "skips_total_count": true }, "optional_summary_mode": { "parameter": "include_targets", "value": false, "returns_affected_programs": true } },
    "opportunities": { "method": "GET", "max_page_size": 100, "self_hosted": false }
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-programs"></a>

### [GET`/api/v1/pro/programs`](https://bbradar.io/docs/api.md#endpoint-programs)

List active and confirmed paused platform programs, plus active Self-Hosted programs, with server-side search, filters, and pagination.

Parameters and examples

Parameters

platforms (csv, optional)

Use platforms=Self-Hosted for only the Self-Hosted catalog

tags (csv, optional; scope, language, or target-type tags)

search (optional; name, handle, platform, policy host, or Self-Hosted target)

updated_since (ISO datetime, optional)

snapshot (optional; start on page 1, then reuse meta.snapshot with the same filters/account; expires after 5 minutes)

page (default: 1)

page_size (max: 100)

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/programs" \
  -G \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=20" \
  --data-urlencode "search=example" \
  --data-urlencode "platforms=hackerone,bugcrowd,Self-Hosted" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "programs": [
    {
      "id": "HackenProof:example-handle",
      "handle": "example-handle",
      "name": "Example Program",
      "platform": "HackenProof",
      "link": "https://hackenproof.com/programs/example-handle",
      "profile_picture": "https://example.com/logo.png",
      "scope_tags": ["domain", "api"],
      "added_at": "2026-03-04T12:10:00Z",
      "date_launched": "2026-03-04",
      "last_updated": "2026-04-16T07:45:02Z",
      "targets_updated_at": "2026-04-16T07:45:02Z",
      "bounty_min": 100,
      "bounty_max": 5000,
      "report_count": 353,
      "submission_cost": {
        "amount": 5,
        "unit": "USD",
        "kind": "fee",
        "source": "hackenproof_catalog",
        "updated_at": "2026-04-16T07:45:02Z"
      },
      "up_votes": 48,
      "down_votes": 3,
      "total_votes": 51,
      "net_score": 45,
      "vote_ratio": 0.9412,
      "star_rating": 5,
      "review_signal": 3.9512437185814275,
      "weighted_sentiment": 19.756218592907137,
      "competitionRisk": "Medium",
      "competitionRiskReason": "Estimated from high public report count, less obvious asset type.",
      "target_counts": {
        "total": 42,
        "in_scope": 38,
        "out_of_scope": 4,
        "eligible_for_bounty": 32,
        "wildcard": 7
      },
      "target_activity": {
        "latest_change_at": "2026-04-16T07:45:02Z",
        "latest_added_at": "2026-04-15T09:20:31Z",
        "added_24h": 3,
        "added_7d": 9,
        "removed_7d": 1
      },
      "extra_data": {
        "report_count": 353,
        "report_count_source": "reports_received_last_90_days",
        "report_count_label": "reports received (last 90 days)"
      }
    }
  ],
  "meta": { "page": 1, "page_size": 20, "total": 120, "total_pages": 6 }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-program-detail"></a>

### [GET`/api/v1/pro/programs/{program_id}`](https://bbradar.io/docs/api.md#endpoint-program-detail)

Fetch one exact platform or Self-Hosted program without scanning list pages.

Parameters and examples

Parameters

program_id (required path param)

program_id format: platform:handle

Self-Hosted example: Self-Hosted:example-security

Handles containing "/" are supported

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/programs/Self-Hosted:example-security" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "id": "Self-Hosted:example-security",
  "handle": "example-security",
  "name": "Example Security",
  "platform": "Self-Hosted",
  "catalog": "self_hosted",
  "link": "https://example.com/security",
  "policy_url": "https://example.com/security",
  "policy_host": "example.com",
  "program_type": "paid",
  "reward_status": "paid",
  "reward_currency": "USD",
  "reward_types": ["cash"],
  "reporting_email": "security@example.com",
  "reporting_url": "https://example.com/report",
  "safe_harbor": "full",
  "verified_at": "2026-08-25T09:00:00Z",
  "scope_tags": ["api", "web"],
  "bounty_min": 100,
  "bounty_max": 5000,
  "report_count": null,
  "submission_cost": null,
  "date_launched": null,
  "data_capabilities": {
    "target_inventory": true,
    "target_changes": false,
    "opportunity_scoring": false,
    "public_report_count": false,
    "submission_cost": false,
    "repository_changes": false
  },
  "target_counts": {
    "total": 8,
    "in_scope": 7,
    "out_of_scope": 1,
    "eligible_for_bounty": 7,
    "wildcard": 2
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-opportunities"></a>

### [GET`/api/v1/pro/opportunities/{level}`](https://bbradar.io/docs/api.md#endpoint-opportunities)

List scored platform programs matching one opportunity tier. Self-Hosted rows are excluded because no opportunity score is fabricated.

Parameters and examples

Parameters

level (required path param: elite|hot|strong|potential)

platforms (csv, optional)

tags (csv, optional; scope, language, or target-type tags)

search (optional; name, handle, or platform)

updated_since (ISO datetime, optional)

page (default: 1)

page_size (max: 100)

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/opportunities/elite" \
  -G \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=20" \
  --data-urlencode "platforms=hackerone,bugcrowd" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "programs": [
    {
      "id": "YesWeHack:example-handle",
      "handle": "example-handle",
      "name": "Example Program",
      "platform": "YesWeHack",
      "link": "https://yeswehack.com/programs/example-handle",
      "profile_picture": "https://example.com/logo.png",
      "scope_tags": ["domain", "api"],
      "added_at": "2026-04-10T12:10:00Z",
      "date_launched": "2026-04-10",
      "last_updated": "2026-04-16T07:45:02Z",
      "targets_updated_at": "2026-04-16T07:45:02Z",
      "bounty_min": 100,
      "bounty_max": 10000,
      "report_count": 1,
      "submission_cost": {
        "amount": 3,
        "unit": "credits",
        "kind": "fee",
        "source": "yeswehack_programs_api",
        "updated_at": "2026-04-16T07:45:02Z"
      },
      "up_votes": 48,
      "down_votes": 3,
      "total_votes": 51,
      "net_score": 45,
      "vote_ratio": 0.9412,
      "star_rating": 5,
      "review_signal": 3.9512437185814275,
      "weighted_sentiment": 19.756218592907137,
      "competitionRisk": "Low",
      "competitionRiskReason": "Estimated from very low public report count, less obvious asset type.",
      "target_counts": {
        "total": 42,
        "in_scope": 38,
        "out_of_scope": 4,
        "eligible_for_bounty": 32,
        "wildcard": 7
      },
      "target_activity": {
        "latest_change_at": "2026-04-16T07:45:02Z",
        "latest_added_at": "2026-04-15T09:20:31Z",
        "added_24h": 3,
        "added_7d": 9,
        "removed_7d": 1
      },
      "extra_data": {
        "report_count": 1,
        "report_count_source": "reports_received_last_90_days",
        "report_count_label": "reports received (last 90 days)"
      },
      "opportunity_tag": {
        "tier": "elite",
        "label": "Elite",
        "description": "Very fresh, lightly reported, and strong payout potential.",
        "reason": "Added 6 days ago • 1 public report • Up to $10,000 bounty",
        "opportunity_score": 97.5,
        "freshness": 100,
        "competition": 100,
        "reward": 90,
        "scope_bonus": 0,
        "signal_count": 3,
        "is_vdp": false
      }
    }
  ],
  "meta": {
    "level": "elite",
    "page": 1,
    "page_size": 20,
    "total": 8,
    "total_pages": 1
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-target-search"></a>

### [GET`/api/v1/pro/targets/search`](https://bbradar.io/docs/api.md#endpoint-target-search)

Reverse-search current platform and Self-Hosted target inventories without scanning program pages.

Parameters and examples

Parameters

q (optional; omit for paginated inventory; 2–512 characters when supplied)

match_mode (contains|exact|suffix|wildcard; default: contains)

snapshot (optional; start on page 1, then reuse meta.snapshot with the same filters/account; expires after 5 minutes)

platforms (csv, optional; supports Self-Hosted)

tags (csv, optional)

include_out_of_scope (bool; default: false)

include_ineligible (bool; default: false)

page (default: 1)

page_size (default: 50, max: 500)

cURL example

```
curl -sS -G "https://bbradar.io/api/v1/pro/targets/search" --data-urlencode "q=api.example.com" --data-urlencode "match_mode=suffix" --data-urlencode "platforms=Self-Hosted" -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "results": [
    {
      "program": {
        "id": "Self-Hosted:example-security",
        "handle": "example-security",
        "name": "Example Security",
        "platform": "Self-Hosted",
        "catalog": "self_hosted",
        "program_type": "paid",
        "policy_url": "https://example.com/security",
        "data_capabilities": {
          "target_inventory": true,
          "target_changes": false
        }
      },
      "target": {
        "target_type": "domain",
        "identifier": "api.example.com",
        "in_scope": true,
        "eligible_for_bounty": true,
        "is_active": true
      }
    }
  ],
  "meta": {
    "q": "api.example.com",
    "match_mode": "suffix",
    "page": 1,
    "page_size": 50,
    "total": 1,
    "total_pages": 1,
    "returned": 1,
    "has_more": false
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-targets"></a>

### [GET`/api/v1/pro/programs/{program_id}/targets`](https://bbradar.io/docs/api.md#endpoint-targets)

Fetch retained active target rows for one platform or Self-Hosted program. Paused parent status is included and bounty eligibility is disabled while paused; Target Intelligence appears only when supported.

Parameters and examples

Parameters

program_id (required path param)

program_id format: platform:handle

Handles can include "/" and are supported in this path

Example: BugCrowd:engagements/example-program

Self-Hosted example: Self-Hosted:example-security

eligibility (all|eligible|ineligible, optional)

target_type (optional)

search (optional; target identifier or display name)

minTargetScore (0-100, optional)

targetOpportunityLabel (Elite Target|Strong Target|Potential Target|Normal, optional)

competitionRisk (Low|Medium|High|Unknown, optional)

page (default: 1)

page_size (default: 250, max: 500)

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/programs/BugCrowd:engagements/example-program/targets" \
  -G \
  --data-urlencode "eligibility=eligible" \
  --data-urlencode "target_type=domain" \
  --data-urlencode "search=api" \
  --data-urlencode "minTargetScore=70" \
  --data-urlencode "targetOpportunityLabel=Strong Target" \
  --data-urlencode "competitionRisk=Low" \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=250" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "targets": [
    {
      "target_type": "domain",
      "identifier": "*.example.com",
      "display_name": "*.example.com",
      "normalized_identifier": "example.com",
      "scope_tags": ["domain", "api"],
      "language_tags": ["javascript"],
      "in_scope": true,
      "eligible_for_bounty": true,
      "severity_score": 8.2,
      "severity_label": "High",
      "metadata": {},
      "source_url": "https://example.com/policy",
      "added_at": "2026-04-15T09:20:31Z",
      "source_added_at": "2026-04-14",
      "last_seen": "2026-04-16T07:45:02Z",
      "last_change_type": "added",
      "last_changed_at": "2026-04-15T09:20:31Z",
      "is_active": true,
      "wildcard": true,
      "targetOpportunityScore": 84,
      "targetOpportunityLabel": "Strong Target",
      "targetScoreBreakdown": {
        "freshness": { "score": 25, "label": "Last 7 days", "days": 3.1 },
        "targetType": { "score": 22, "label": "Wildcard", "key": "wildcard" },
        "reward": { "score": 22, "label": "High bounty", "maxBounty": 10000, "isNoReward": false },
        "reportActivity": { "score": 15, "label": "Very low public report count", "reportCount": 1, "fallback": null }
      },
      "competitionRisk": "Low",
      "competitionRiskReason": "Estimated from very low public report count, recent target change, less obvious asset type.",
      "whyThisTarget": "Fresh wildcard scope expansion, with eligible and in scope, high bounty potential, low competition risk."
    }
  ],
  "meta": {
    "page": 1,
    "page_size": 250,
    "total": 9809,
    "total_pages": 40,
    "returned": 250,
    "has_more": true
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-target-export"></a>

### [POST`/api/v1/pro/targets/export`](https://bbradar.io/docs/api.md#endpoint-target-export)

Export up to 500 current platform or Self-Hosted targets in one bounded request. Each JSON row preserves its parent program_id.

Parameters and examples

Parameters

program_ids (array, optional; max: 50)

platforms (array, optional; max: 15)

tags (array, optional; max: 25)

opportunity_levels (array: elite|hot|strong|potential; platform programs only)

include_out_of_scope (bool; default: false)

include_ineligible (bool; default: false)

format (json|csv; default: json)

limit (default/max: 500)

Request body size (max: 65,536 bytes)

When program_ids is non-empty it is the authoritative selection; catalog filters are ignored

Paused program scopes require explicit program_ids and include_ineligible=true; their bounty eligibility remains false

cURL example

```
curl -sS -X POST "https://bbradar.io/api/v1/pro/targets/export" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"program_ids":["Self-Hosted:example-security"],"include_out_of_scope":false,"include_ineligible":false,"format":"json","limit":500}'
```

Example response

```
{
  "targets": [
    {
      "program_id": "Self-Hosted:example-security",
      "platform": "Self-Hosted",
      "program_handle": "example-security",
      "program_name": "Example Security",
      "catalog": "self_hosted",
      "target_type": "domain",
      "identifier": "api.example.com",
      "in_scope": true,
      "eligible_for_bounty": true,
      "wildcard": false,
      "is_active": true
    }
  ],
  "format": "json",
  "total": 1,
  "generated_at": "2026-08-25T09:00:00Z",
  "meta": {
    "returned": 1,
    "limit": 500,
    "has_more": false,
    "truncated": false,
    "programs_returned": 1
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-changes"></a>

### [GET`/api/v1/pro/targets/changes`](https://bbradar.io/docs/api.md#endpoint-changes)

Retrieve latest target additions, updates, and removals with target, parent-program, and submission-cost intelligence.

Parameters and examples

Parameters

change_type (added|readded|updated|removed)

snapshot (optional; start on page 1, then reuse meta.snapshot with the same filters/account; expires after 5 minutes)

include_removed (bool, optional)

include_ineligible (bool, optional)

include_out_of_scope (bool, optional)

search (min length: 2, optional)

platforms (csv, optional)

tags (csv, optional; scope, language, or target-type tags)

minTargetScore (0-100, optional)

targetOpportunityLabel (Elite Target|Strong Target|Potential Target|Normal, optional)

competitionRisk (Low|Medium|High|Unknown, optional)

page (default: 1)

page_size (max: 100)

after_id (optional; incremental polling cursor, page must remain 1)

Cursor mode is oldest-first, scans at most 2,000 candidate rows, omits totals and facets, and returns next_after_id

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/targets/changes" \
  -G \
  --data-urlencode "change_type=added" \
  --data-urlencode "search=example" \
  --data-urlencode "minTargetScore=70" \
  --data-urlencode "targetOpportunityLabel=Strong Target" \
  --data-urlencode "competitionRisk=Low" \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=50" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "results": [
    {
      "id": 48102,
      "change_type": "added",
      "changed_at": "2026-04-15T09:20:31Z",
      "program": {
        "id": "Sherlock:example-program",
        "handle": "example-program",
        "name": "Example Program",
        "platform": "Sherlock",
        "link": "https://audits.sherlock.xyz/bug-bounties/example-program",
        "scope_tags": ["domain", "api"],
        "bounty_min": 100,
        "bounty_max": 5000,
        "submission_cost": {
          "amount": 0,
          "maximum_amount": 250,
          "unit": "USDC",
          "kind": "deposit",
          "source": "sherlock_bug_bounties_api",
          "updated_at": "2026-04-16T07:45:02Z"
        },
        "profile_picture": "https://example.com/logo.png",
        "date_launched": "2026-03-04",
        "targets_updated_at": "2026-04-16T07:45:02Z",
        "competitionRisk": "Low",
        "competitionRiskReason": "Estimated from low public report count, less obvious asset type."
      },
      "target": {
        "identifier": "*.api.example.com",
        "normalized_identifier": "api.example.com",
        "display_name": "*.api.example.com",
        "type": "domain",
        "scope_tags": ["domain", "api"],
        "language_tags": ["javascript"],
        "in_scope": true,
        "eligible_for_bounty": true,
        "wildcard": true,
        "source_url": "https://example.com/policy",
        "added_at": "2026-04-15T09:20:31Z",
        "source_added_at": "2026-04-14",
        "last_seen": "2026-04-16T07:45:02Z",
        "is_active": true,
        "severity_score": 8.2,
        "severity_label": "High",
        "targetOpportunityScore": 87,
        "targetOpportunityLabel": "Elite Target",
        "targetScoreBreakdown": {
          "freshness": { "score": 35, "label": "Last 24 hours", "days": 0.4 },
          "targetType": { "score": 22, "label": "Wildcard", "key": "wildcard" },
          "reward": { "score": 18, "label": "Strong bounty", "maxBounty": 5000, "isNoReward": false },
          "reportActivity": { "score": 12, "label": "Low public report count", "reportCount": 4, "fallback": null }
        },
        "competitionRisk": "Low",
        "competitionRiskReason": "Estimated from low public report count, recent target change, less obvious asset type.",
        "whyThisTarget": "Fresh wildcard scope expansion, with eligible and in scope, strong reward potential, low competition risk."
      },
      "metadata": {},
      "diff": {}
    }
  ],
  "meta": {
    "page": 1,
    "page_size": 50,
    "total": 218,
    "total_pages": 5,
    "change_type": "added",
    "included_change_types": ["added"],
    "include_removed": false,
    "include_ineligible": false,
    "include_out_of_scope": false,
    "last_sync": "2026-04-16T07:45:02Z",
    "previous_sync": "2026-04-16T07:44:11Z",
    "applied_since": null
  },
  "facets": {
    "platforms": [
      { "value": "hackerone", "label": "HackerOne", "count": 120 }
    ],
    "tags": [
      { "value": "domain", "label": "domain", "count": 163 }
    ]
  }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="endpoint-repository-changes"></a>

### [GET`/api/v1/pro/repositories/changes`](https://bbradar.io/docs/api.md#endpoint-repository-changes)

Retrieve bounded repository/ref transitions and their affected platform programs and targets. The response contains no patches, source code, commit messages, changed paths, filenames, or diff statistics.

Parameters and examples

Parameters

search (2-128 characters, optional; repository, ref, platform, program, or target)

platforms (csv, optional; max: 15)

tags (csv, optional; scope, language, or target-type tags; max: 25)

free_submission_only (bool; default: false)

snapshot (optional; start on page 1, then reuse meta.snapshot with the same filters/account; expires after 5 minutes)

include_removed (bool; default: false)

include_ineligible (bool; default: false)

include_out_of_scope (bool; default: false)

page (default: 1)

page_size (default: 50, max: 100)

after_id (optional; incremental polling cursor, page must remain 1)

include_targets (bool; default: true; false omits nested targets but preserves affected programs)

Cursor mode is oldest-first, skips the total-count query, and returns next_after_id

minTargetScore, targetOpportunityLabel, and competitionRisk require page mode and cannot be combined with after_id

Global facet aggregation is omitted so automation requests do not scan the full repository-link catalog

Requests exceeding 5,000 nested program/target associations return 413; narrow filters or page_size

Platform catalog only; Self-Hosted repository-change coverage is unavailable

cURL example

```
curl -sS -X GET "https://bbradar.io/api/v1/pro/repositories/changes" \
  -G \
  --data-urlencode "search=contracts" \
  --data-urlencode "platforms=Immunefi" \
  --data-urlencode "tags=solidity" \
  --data-urlencode "page=1" \
  --data-urlencode "page_size=50" \
  -H "Authorization: Bearer YOUR_PRO_API_KEY"
```

Example response

```
{
  "results": [
    {
      "id": 17042,
      "event_type": "push",
      "source": "poll",
      "ref_name": "main",
      "before_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "after_sha": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "observed_at": "2026-08-27T05:30:00Z",
      "repository": {
        "provider": "github",
        "provider_host": "github.com",
        "full_name": "example/contracts",
        "url": "https://github.com/example/contracts"
      },
      "changes_url": "https://github.com/example/contracts/compare/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
      "link_type": "compare",
      "programs": [
        { "id": "Immunefi:example", "platform": "Immunefi", "handle": "example", "name": "Example Protocol" }
      ],
      "targets": [
        {
          "id": 901,
          "type": "source code",
          "identifier": "https://github.com/example/contracts",
          "path_kind": "repository",
          "path_prefix": null,
          "in_scope": true,
          "eligible_for_bounty": true,
          "is_active": true,
          "scope_tags": ["smart contract", "source code"],
          "language_tags": ["solidity"]
        }
      ]
    }
  ],
  "meta": { "page": 1, "page_size": 50, "total": 1, "total_pages": 1 }
}
```

See [Errors and retries](https://bbradar.io/docs/api.md#errors) for invalid requests, authentication, expiry, size limits, and temporary failures.

<a id="limits"></a>

## Rate and concurrency limits

ScopeLimitNotes

Programs and opportunities`80 requests/min`

/programs and /opportunities/{level} share this endpoint bucket.

Targets, search, and export`40 requests/min`

/programs/{program_id}/targets, /targets/search, and /targets/export share this endpoint bucket.

Target and repository changes`30 requests/min`

/targets/changes and /repositories/changes share this endpoint bucket.

Global key bucket`120 requests/min, burst 300`

Shared by all Pro API v1 requests for the same API key.

Per key + IP bucket`60 requests/min`

Applied to one API key from one source IP.

Concurrent requests`8 per key, 3 change feeds`

Target and repository changes share a smaller concurrent cap because they are the heaviest endpoints.

Distinct IP guard`5 IPs/hour`

Exceeding this locks the key for 10 minutes. Three locks in 24 hours locks it for 24 hours.

Responses include `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset`. A `429` response also includes `Retry-After`.

<a id="errors"></a>

## Errors and retries

Retry only transient failures, reduce concurrency, and use jitter to avoid synchronized traffic.

`400`

Invalid parameter or request shape.

Correct the request; do not retry it unchanged.

`401`

Missing, malformed, revoked, or incorrect API key.

Check the Bearer header and the current key.

`402`

The account no longer has active Pro access.

Restore Pro access before retrying.

`404`

The requested program or resource was not found.

Verify the composite program ID and URL encoding.

`410`

A snapshot expired or the change cursor predates retained history.

Start a fresh snapshot on page 1, or reconcile current inventory before restarting the change cursor.

`413`

A request body, snapshot, or repository association result exceeds its size limit.

Narrow the selection or reduce the page size; do not retry the same oversized request.

`423`

The key is temporarily locked by abuse protection.

Stop traffic and wait until the lock expires.

`429`

A rate or concurrency limit was exceeded.

Honor Retry-After and retry with exponential jitter.

`503`

A required service is temporarily unavailable.

Honor Retry-After when present and retry with bounded backoff.

---

# Find opportunities with Pro discovery | bbradar.io

> Find changing programs with activity labels and sorting, search targets, compare rewards and competition, and build your next research shortlist.

Source: [https://bbradar.io/docs/pro/discovery](https://bbradar.io/docs/pro/discovery)

<a id="target-search"></a>

## [Search target identities](https://bbradar.io/docs/pro/discovery.md#target-search)

The catalog covers 25 platforms, including [HackZar](https://bbradar.io/platforms/hackzar). Enable **Include VDPs** for recognition-only programs. HackZar includes public scope and total report counts. Its catalog dates use the Created date published on each program page, with a conservative estimate when that date is unavailable. Select HackZar in [Notification Rules](https://bbradar.io/account/notifications) to filter private alerts to that platform.

1. ### Open the program catalog

   Go to the [bbradar catalog](https://bbradar.io/) while signed in with Pro.
2. ### Enter a target fragment

   Type at least three characters from a hostname, package, repository, contract, IP range, or another known target identity.
3. ### Review the match context

   Target-aware results show the program attached to the matching active target. Use a distinctive fragment when a broad word returns too many programs.
4. ### Open the program

   Review Overview for rewards and recent changes, then select **Targets** to explore scope.

Sanitized product view

Discover programs

Search programs and active target identities

Pro

api.example.test

Acme Cloud

ELITE

api.example.test

Low dupe risk

Nova Wallet

HOT

api.example.test

Medium dupe risk

Pro target search with program opportunity tiers and dupe-risk signals. Example data and credentials are fictional or redacted; named product controls match the interface.

Tip

Use a distinctive hostname fragment instead of a broad word. Target-aware search is designed for finding programs attached to a known asset.

[Search the program catalogFind a program by name, handle, or active target identity.](https://bbradar.io/)

<a id="opportunity-tiers"></a>

## [Use opportunity tiers](https://bbradar.io/docs/pro/discovery.md#opportunity-tiers)

| Program tier | What it highlights |
| --- | --- |
| Elite | Very fresh, lightly reported programs with strong payout potential. |
| Hot | Fresh programs with low visible competition and attractive rewards. |
| Strong | Paid programs with a low public report count and solid potential, including older programs. |
| Potential | Paid programs with a modest public report count that may be overlooked. |

Use program tiers to build a research shortlist, then review the policy and program details before deciding what to investigate.

1. ### Find the Opportunity row

   On the catalog, locate the Elite, Hot, Strong, and Potential chips above the program list.
2. ### Select one or more tiers

   Selected tiers work as alternatives, so choosing Elite and Hot shows programs in either tier.
3. ### Combine with catalog filters

   Narrow the results further with platform, tags, rewards, status, or search as needed.
4. ### Clear the tier filter

   Select the active chip again or use the clear action to return to the full catalog.

Program tiers and target labels are different

Elite, Hot, Strong, and Potential classify programs. Elite Target, Strong Target, Potential Target, and Normal classify individual targets from their 0–100 Target Opportunity Score.

Tiers are discovery aids, not guarantees of payout, valid vulnerability classes, or low duplicate counts. Always read the program policy and validate eligibility before testing.

<a id="activity-sorting"></a>

## [Find programs that are changing](https://bbradar.io/docs/pro/discovery.md#activity-sorting)

Use Pro activity labels to spot new scope, higher rewards and frequent updates while browsing. Red labels also flag scope reductions and lower rewards, so you can reassess a program before spending more time on it.

| Sort By | Use it to |
| --- | --- |
| Recently updated | Catch up on the programs that changed most recently. |
| Most active (30 days) | Find programs that have been changing regularly. |
| Largest scope change (7 days) | Review the biggest recent scope updates first. |
| Paid out (7 or 30 days) | Order comparable tracked payout increases for the selected listing period, when available. |

Combine these sorts with your platform, tag and reward filters. Pro listing rows show the available Paid 7d and Paid 30d values together. A dash means there is no usable value for that period; it is not zero.

Most active and Largest scope change remain in the catalog’s sort menu. Open [Activity](https://bbradar.io/activity) for the dedicated sortable views and additional periods. The four label families open evidence and link to the relevant Activity view or the program’s Signals, History or Payouts section.

[Read activity labelsSee what each label means and explore the changes behind it.](https://bbradar.io/docs/pro/program-history.md#activity-labels)

<a id="competition"></a>

## [Read competition signals](https://bbradar.io/docs/pro/discovery.md#competition)

Pro report-count badges also show dupe risk. The icon and color help you compare competition at a glance: green for Low, yellow for Medium and red for High. Hover over the count to read the risk level.

If a risk estimate is unavailable, the report count keeps its neutral appearance. You can also sort by report count to compare programs.

<a id="methodology"></a>

## [How signals are produced](https://bbradar.io/docs/pro/discovery.md#methodology)

bbradar combines observations from supported program sources. Publication follows successful retrieval and verification; source availability, rate limits, and incomplete checks can delay changes. A discovery date is the time bbradar first observed a program, unless a separate upstream launch date is provided.

Opportunity and target scores use available freshness, rewards, target type, and public report activity. Factor breakdowns expose the contributing evidence. Model versions and evidence coverage in the API help distinguish a scoring change from a new source observation. A public report count may cover a platform-specific period; inspect its source label before comparing programs.

Missing evidence remains missing. Unknown dupe risk does not mean low competition, and a score does not estimate exploitability, expected earnings, or permission to test. Self-Hosted programs do not receive fabricated opportunity scores or platform history.

Confirmed paused programs remain visible for reference with retained scope and rewards. They are excluded from active opportunity results and their current bounty eligibility is disabled. Recorded lifecycle and catalog events can still appear in Activity. Always open the current official policy before selecting work.

<a id="example-walkthrough"></a>

## [An example research shortlist](https://bbradar.io/docs/pro/discovery.md#example-walkthrough)

Illustrative example

Example Program and `api.example.com` below are fictional teaching data. They do not represent a listed customer or a testing invitation.

1. ### Choose a program

   Filter the catalog by the platform and asset categories relevant to your work. Open Example Program and inspect its status, reward description, and official policy link.
2. ### Review an eligible target

   With Pro, open Program Targets. An example row for `api.example.com` might be in scope with a score of 74 and the label Strong Target. Check the factor breakdown and source observation, not just the score.
3. ### Interpret an unknown signal

   If dupe risk is Unknown, public evidence is insufficient. Keep that uncertainty in your shortlist instead of treating it as low competition.
4. ### Save a relevant alert

   Use the target’s alert shortcut, review the draft in Notification Rules, and select Save Rules. Keep only the streams and filters you want; a prefilled draft is not saved automatically.

The result is a short, evidence-based list to review against current program policies. An alert records a change; it does not authorize an interaction with an asset.

<a id="upcoming"></a>

## [Track upcoming programs](https://bbradar.io/docs/pro/discovery.md#upcoming)

Future-dated contest programs remain publicly visible. Pro can also surface upcoming non-contest programs within the configured visibility window, giving you time to read policies and prepare research workflows before launch.

[Investigate targetsOpen the full active scope inventory.](https://bbradar.io/docs/pro/program-targets.md)[Alert on upcoming launchesKeep the Upcoming event stream enabled.](https://bbradar.io/docs/notifications/rules.md)

---

# Use the verified Self-Hosted catalog | bbradar.io

> Find bug bounty programs run directly by organizations, compare rewards and scope, review program History, and set up new-program alerts.

Source: [https://bbradar.io/docs/pro/self-hosted](https://bbradar.io/docs/pro/self-hosted)

<a id="catalog-boundary"></a>

## [Open the Self-Hosted catalog](https://bbradar.io/docs/pro/self-hosted.md#catalog-boundary)

Self-Hosted Programs is a separate Pro catalog for security programs operated directly by organizations. Use it to browse paid bug bounties, include VDPs when useful, and open each program’s official policy and reporting route.

<a id="browse"></a>

## [Browse and filter programs](https://bbradar.io/docs/pro/self-hosted.md#browse)

1. ### Open the Self-Hosted catalog

   Go to [Self-Hosted Programs](https://bbradar.io/self-hosted) while signed in with Pro.
2. ### Start with the paid list

   The default view shows paid bug bounties, with the newest additions first.
3. ### Include VDPs when needed

   Turn on **Include VDPs** to add verified no-monetary-reward disclosure policies.
4. ### Search and filter

   Search names, domains, and structured targets, or filter by program type, scope tags, reward types, scope features such as wildcard coverage, and target type.
5. ### Choose another view or sort

   Switch between list and grid, or sort by newest or oldest discovery, name, or maximum bounty from high to low or low to high.

[Open the Self-Hosted catalogBrowse verified paid programs and optional VDPs.](https://bbradar.io/self-hosted)

<a id="profiles"></a>

## [Read a program profile](https://bbradar.io/docs/pro/self-hosted.md#profiles)

A detail page brings the official policy, reporting route, reward range, and structured targets together. Use the policy and reporting buttons to verify current rules before testing or submitting a report.

Start with **Overview** for a quick look at scope and recent changes, then select **History** to explore profile and scope updates. The [Program History guide](https://bbradar.io/docs/pro/program-history.md) shows how to compare changes.

| Profile field | Meaning |
| --- | --- |
| Paid or VDP | Paid means the official program information advertises a monetary reward. VDP means no monetary reward was confirmed. |
| Safe harbor | Full, partial, stated, or not stated according to the official policy wording. |
| Program Targets | Available in-scope and out-of-scope entries. An empty section does not mean the policy has no scope. |

Important

The organization’s current official policy is authoritative. Recheck authorization, scope, testing restrictions, and reward terms before interacting with any asset.

<a id="alerts"></a>

## [Configure Self-Hosted alerts](https://bbradar.io/docs/pro/self-hosted.md#alerts)

Notification Rules have separate streams for newly verified paid programs and newly verified VDPs. Paid Self-Hosted alerts start enabled; VDP alerts start disabled so no-reward policies do not add noise unless you opt in.

1. ### Connect Telegram

   Use a private Telegram chat for rules personalized to your account.
2. ### Open Notification Rules

   Enable **Self-Hosted bounties**, **Self-Hosted VDPs**, or both.
3. ### Set filtered mode if needed

   Select Self-Hosted in Platforms and add compatible program-level filters such as reward bounds or program includes and excludes.
4. ### Save the rule

   Wait for the saved confirmation before leaving the page.

Self-Hosted entries do not currently have the platform catalog’s opportunity tiers, submission-cost signals, target-change alert stream or repository-change stream. Browser History records accepted structured changes separately; it does not add those notification filters or alert streams.

[Build Self-Hosted alert rulesChoose paid or VDP streams and review matching behavior.](https://bbradar.io/docs/notifications/rules.md)

<a id="limitations"></a>

## [Data boundaries and limitations](https://bbradar.io/docs/pro/self-hosted.md#limitations)

- Reward information can be incomplete when the official policy does not publish exact amounts
- An empty target inventory does not mean every asset is allowed
- Policies, scope, rewards, and reporting routes can change
- The browser History tab covers accepted structured changes without exposing fetched policy bodies, evidence snippets or reporting contacts
- Self-Hosted profiles and active targets are available through the Pro API and MCP; separate History tools expose supported recorded changes. Opportunity tiers, target-change feeds and repository changes are not added to the Self-Hosted catalog.

If anything in a profile conflicts with the official policy, stop and follow the official policy. Use the profile links to review the current rules directly.

---

# Investigate program targets | bbradar.io

> Inspect active scope identities, export targets, and interpret target scores, labels, factor breakdowns, and dupe risk.

Source: [https://bbradar.io/docs/pro/program-targets](https://bbradar.io/docs/pro/program-targets)

<a id="open-targets"></a>

## [Open the target inventory](https://bbradar.io/docs/pro/program-targets.md#open-targets)

1. ### Find a program

   Use the [program catalog](https://bbradar.io/) or target-aware search and select a result.
2. ### Confirm Pro access

   Stay signed in with the Pro account. Free users see aggregate target counts, while Pro users receive the active identities.
3. ### Scroll to Program Targets

   The section appears below the program summary and shows the last update time plus the number of visible targets.
4. ### Check the upstream policy

   Use **Scope source** on a target when available. The platform policy remains authoritative if anything differs.

Sanitized product view

Acme Cloud targets

12 active targets · updated recently

Pro

Search targets

api.example.testIN SCOPE

*.mobile.example.testIN SCOPE

github.com/example/research-demoIN SCOPE

Target Intelligence

84/100

Strong TargetLow dupe risk

Freshness · 25 pts

Target type · 25 pts

Reward · 22 pts

Report activity · 12 pts

Program target inventory with Target Opportunity Score, label, breakdown, and dupe risk. Example data and credentials are fictional or redacted; named product controls match the interface.

Paused programs

A paused program can retain previously published target rows for reference. Its page identifies the paused state and disables current bounty eligibility; these rows do not establish current permission to test.

[Open the program catalogFind a program, then inspect its Program Targets section.](https://bbradar.io/)[Compare changes over timeOpen History beside Targets to review accepted changes recorded for this program.](https://bbradar.io/docs/pro/program-history.md)

<a id="filter-targets"></a>

## [Filter and inspect targets](https://bbradar.io/docs/pro/program-targets.md#filter-targets)

1. ### Choose an eligibility view

   Select **All targets**, **Eligible for bounty**, or **No bounty**.
2. ### Search the identities

   Use **Search targets** to narrow the current program by hostname, package, repository, contract, or other identifier text.
3. ### Choose a target-type tab

   Use All or a type tab such as Domain, URL, Source Code, Mobile, IP Range, or Smart Contract. The count on each tab reflects the current filters.
4. ### Inspect a target card

   Review New, bounty eligibility, scope, wildcard, type, score, label, dupe risk, dates, and the source link when those fields are available.

Important

Always follow the authoritative platform policy if a bbradar identity and the upstream program page disagree.

<a id="intelligence"></a>

## [Read target intelligence](https://bbradar.io/docs/pro/program-targets.md#intelligence)

The Target Intelligence panel shows a score out of 100, its label, a factor breakdown, a dupe-risk badge and reason, and a plain-language Why This Target explanation.

| Target label | Score | Use |
| --- | --- | --- |
| Elite Target | 85–100 | Review the strongest combined target signals first. |
| Strong Target | 70–84 | Prioritize a target with several favorable signals. |
| Potential Target | 50–69 | Keep it in a broader research shortlist. |
| Normal | 0–49 | Treat it as standard scope and inspect manually. |

Dupe risk runs from Low to High, where higher is worse. Unknown means there is not enough public information for a reliable estimate. A fresh or unusual asset can still be heavily researched, so use the displayed reason rather than the color alone.

Important

A high score is not permission to test. Confirm the target is active, in scope, and allowed by the upstream program rules before interacting with it.

<a id="export"></a>

## [Copy or export scope](https://bbradar.io/docs/pro/program-targets.md#export)

1. ### Set the intended filters

   Choose the eligibility view, target-type tab, and search term before exporting.
2. ### Review the selection label and count

   The export panel describes the filtered targets that will be included.
3. ### Copy or download

   Select **Copy targets** for the clipboard or download the text file for the current selection.
4. ### Recheck authorization

   Treat the export as a working list only. It does not replace the upstream policy or grant permission to test.

<a id="prefill-alert"></a>

## [Prefill a target alert](https://bbradar.io/docs/pro/program-targets.md#prefill-alert)

1. ### Select Create target alert

   Use the action beside Program Targets. bbradar opens Notification Rules with Target changes enabled and the program added to the draft.
2. ### Review the prepared draft

   Confirm the match mode, target-change types, Telegram delivery, program include, and any opportunity or dupe-risk filters.
3. ### Save the prepared rule

   Select **Save prepared rule** in the preparation banner or **Save Rules** in the Current rule panel.
4. ### Confirm the save

   Do not leave until the page shows the saved confirmation. Opening the prefilled page alone changes nothing.

---

# Explore program History and activity | bbradar.io

> Compare payouts, value, scope, reports and response in Activity. Read program payout facts, follow activity labels and compare before and after details in History.

Source: [https://bbradar.io/docs/pro/program-history](https://bbradar.io/docs/pro/program-history)

<a id="open-history"></a>

## [Get the full picture of a program](https://bbradar.io/docs/pro/program-history.md#open-history)

See what changed before deciding where to spend your time. With Pro, read recent activity, scope and change history in one place, alongside available payout facts.

| Tab | Use it to |
| --- | --- |
| Overview | Get a quick read on rewards, scope and recent changes, and open Signals for the evidence behind activity labels. |
| Targets | Explore the current scope and choose targets to investigate. |
| Payouts | Read supported programs’ payout totals, measured increases and their source figures. |
| History | Follow changes over time and compare before and after details. |

[Choose a programOpen a program to explore its current scope, payout facts and recorded changes.](https://bbradar.io/)

<a id="activity-page"></a>

## [Compare programs in Activity](https://bbradar.io/docs/pro/program-history.md#activity-page)

Open [Activity](https://bbradar.io/activity) to compare one measure and period at a time. Pro members can search, filter and sort the available views. Everyone can open the page; its free preview shows public change counts and illustrative locked rows.

| View | Compare |
| --- | --- |
| Paid out | Payouts reported by the platform or increases in its published total observed by BBRadar. |
| Value | Payout per processed report and 90-day report volume, compared within each platform, with a map and label-specific shortlists. |
| Scope | Added, removed and net in-scope targets, the largest update, and current scope. |
| Rewards | Reward ranges before and after the period, and the change in maximum reward. |
| Updates | Days with changes, change counts, categories and the latest change. |
| Reports | Received or submitted reports during the period, with like-for-like previous-period comparisons. |
| Response | Resolved, accepted or rewarded counts and available response or bounty-award timings. |
| Status | First seen, paused, resumed, left listing and returned events. |
| All changes | Individual recorded changes, with expandable before and after details. |

Choose 7, 30 or 90 days from the available periods. Paid out, Reports and Response can also offer All-time. Value uses fixed lifetime and 90-day definitions. All-time counts have no previous-period comparison. Controls show the supported rankings; filtering one to a single platform is fine. A saved link keeps its selected view and period, even when that view is unavailable or the filters match no programs.

On a phone, rankings use one card per program. Status and All changes keep separate events for the same program. Program links open the relevant Payouts, Overview or History section with the selected period. Expand All changes to inspect an event without leaving the page. Status opens the recorded lifecycle details, including events for programs that have left the catalog.

[Open ActivityCompare payouts and program changes with the same filters and periods.](https://bbradar.io/activity)

<a id="payout-values"></a>

## [Read payouts and report counts](https://bbradar.io/docs/pro/program-history.md#payout-values)

Pro catalog rows show **Paid 7d** and **Paid 30d** when those listing measures are available. They measure increases in a platform’s published running total. Use the matching payout sort to compare programs, or open Payouts for the underlying totals and other available periods.

| Value | Meaning |
| --- | --- |
| Reported | The platform publishes the amount for the stated period or lifetime. |
| Tracked | BBRadar observed an increase between comparable readings of a running total. |
| $125k–$130k or > $1m | The source gives a range or a bound. It is not an exact amount. |
| — | No usable value for this program and period. This does not mean zero. |
| $0 | A usable, comparable measurement with no increase during the stated period. |

Highest reported minimum orders exact values and ranges by their lowest possible amount. Lowest reported maximum uses the highest possible amount. These orders preserve what the source proves; they do not turn a range into an exact payout. Amounts keep their source currency, with recorded exchange rates used for USD ordering. The date an increase was observed is not a payment date, and providers can update totals late.

Reports uses measured growth of received or submitted counters where possible, with a platform’s supported period figure used where no lifetime counter exists. A native figure is labelled reported. Previous period and Change compare the same measure. Report volume alone does not measure competition or duplicate risk. Response keeps the platform’s resolved, accepted or rewarded definition; time to bounty is award timing, not payment settlement.

<a id="activity-labels"></a>

## [Spot changes with activity labels](https://bbradar.io/docs/pro/program-history.md#activity-labels)

Pro activity labels highlight what is happening in a program, right in the catalog and on its details page. Spot new scope and higher rewards, or notice reductions before returning to a program.

| Label | What it tells you |
| --- | --- |
| Recently updated | Program details changed recently. |
| High activity | The program has changed on several recent days. |
| Scope expanded / Scope reduced | The program has more or fewer targets in scope. |
| Large scope change | A larger set of scope entries changed together. |
| Rewards increased / Rewards decreased | The published reward range went up or down. |
| Seen 3d ago | When an increase in the published payout total was observed; this is not the payment date. |
| Steady payer / Paying more | Increases seen in many weeks, or materially larger observed increases in the current 30 days. |
| Pays near top | Average observed increase ranks in the platform’s top quarter relative to the current top reward; the explanation shows the actual amounts and percentage. |
| High value / Popular / Low per report | Within-platform comparisons of payout per processed report and 90-day report volume. |
| Fresh scope | Scope expanded while recent report growth stayed at or below its earlier weekly pace. |
| No payouts seen | Reports grew while a comparable public payout total stayed unchanged for 90 days; offered only for evidence-validated sources. |
| Quiet | No changes, increases or new reports seen during 90 days of qualified monitoring. |
| Lower payout activity | The tracked 30-day increase was materially lower than the previous 30 days. |
| No payout increase observed | A comparable public payout total stayed unchanged over 30 days. |

Catalog rows use four fixed positions: Paying, Value, Scope and Updates. Empty families stay blank. Each shows one label, with cautions first within the family. Select a chip for every label in that family and its evidence; on a phone this opens a bottom sheet. Scope labels show net movement, such as Scope +12. Follow an explanation to its matching Activity shortlist or program details, or choose See all signals for the full panel. The 30-day no-increase note stays on program details.

Use **Sort By** in the platform catalog to put recently updated programs, the most active programs or the largest scope changes first. The [discovery guide](https://bbradar.io/docs/pro/discovery.md#activity-sorting) helps you choose a view.

<a id="value-signals"></a>

## [Compare value with the evidence in view](https://bbradar.io/docs/pro/program-history.md#value-signals)

The Value map compares reports received in 90 days with lifetime payout per accepted or resolved report. Ranks are calculated within each platform before you filter; changing a filter does not change a program’s rank. The map shows every matching program with both inputs, while each label’s shortlist uses that label’s own evidence. If the map is too large, narrow the filters. These measures describe public observations, not individual report rewards, duplicate risk or a promise of future payments.

Program Signals includes the last payout increase seen, actual weeks with increases, average observed increase, its share of the published top reward, and processed versus received reports when available. Processed vs received can exceed 100% when older reports are handled. Its two data sources are shown; it does not measure response speed.

<a id="read-a-change"></a>

## [Filter the timeline and compare changes](https://bbradar.io/docs/pro/program-history.md#read-a-change)

1. ### Open History

   Select History on a program’s details page, or follow a recent change from Overview.
2. ### Focus on what matters

   Choose a date range and a category, such as Scope, Rewards or Rules & policy.
3. ### Compare the details

   Open a change to see what was added, removed or edited, with before and after values.
4. ### Follow up

   Open Targets to explore the current scope, or follow the source link for the full program update.

Use All history and All events to browse the full timeline. Dates are shown with each update, with times in UTC. Bookmark the History tab to return to it later.

<a id="change-coverage"></a>

## [Know what changed](https://bbradar.io/docs/pro/program-history.md#change-coverage)

| Category | What to look for |
| --- | --- |
| Scope | Targets added, removed or changed. |
| Rewards | Changes to published rewards and payout terms. |
| Rules & policy | Updates to program rules, requirements and impact descriptions. |
| Program | Profile, status and schedule updates. |
| Repositories | Repository updates linked to the program. |

You can also use History on Self-Hosted programs to follow profile and scope changes.

<a id="access-and-tools"></a>

## [Keep up with programs you follow](https://bbradar.io/docs/pro/program-history.md#access-and-tools)

Activity, program payout facts, History and activity labels are included with Pro. Use [Latest Targets and Commits](https://bbradar.io/latest-targets) to browse changes across programs, and set up [personal alerts](https://bbradar.io/docs/notifications.md) for the updates you want to follow.

The [Pro API](https://bbradar.io/docs/api.md) and [MCP tools](https://bbradar.io/docs/mcp.md) use the same calculations and availability rules. Clients first discover the supported Activity views, then request one page with explicit periods and filters. They can combine payout, report and activity conditions in a single program query. An unavailable 7-day request is not replaced with a 90-day value.

[Explore current scopeFind targets for your next research session.](https://bbradar.io/docs/pro/program-targets.md)[Follow repository updatesSee which bounty repositories are changing.](https://bbradar.io/docs/pro/repository-changes.md)

---

# Follow the latest target changes | bbradar.io

> Monitor material scope movement and filter target or Commits feeds by score, opportunity label, and dupe risk.

Source: [https://bbradar.io/docs/pro/latest-changes](https://bbradar.io/docs/pro/latest-changes)

<a id="change-tabs"></a>

## [Understand the change tabs](https://bbradar.io/docs/pro/latest-changes.md#change-tabs)

1. ### Open Latest Targets

   Go to [Latest Targets](https://bbradar.io/latest-targets) while signed in with Pro.
2. ### Choose a feed tab

   Select Added, Re-added, Updated, Removed, or Commits. Only one feed tab is active at a time.
3. ### Review the result card

   Check the program, platform, target identity or repository mapping, timestamps, scope state, opportunity label, score, and dupe risk when available.
4. ### Open the source context

   Use the program or external source link to validate the event against the authoritative platform or repository-host page.

Sanitized product view

Latest changes

Material bounty-scope movement

Pro

AddedRe-addedUpdatedRemovedCommits

Min score: 70Strong TargetLow dupe risk

api.example.test

Acme Cloud · HackerOne

78/100 · Strong Target · Low dupe risk

ADDED

shop.example.test

Acme Cloud · HackerOne

74/100 · Strong Target · Low dupe risk

ADDED

Latest Targets feed filtered by minimum score, opportunity label, and dupe risk. Example data and credentials are fictional or redacted; named product controls match the interface.

| Tab | Meaning |
| --- | --- |
| Added | A new target entered active scope. |
| Re-added | A previously seen target returned to active scope. |
| Updated | An important detail of an existing target changed. |
| Removed | A target was confirmed as no longer active scope. |
| Commits | A supported repository branch changed; this is a separate repository feed. |

[Open Latest TargetsReview scope movement and repository branch updates.](https://bbradar.io/latest-targets)

<a id="search-filter"></a>

## [Search and filter](https://bbradar.io/docs/pro/latest-changes.md#search-filter)

1. ### Search with at least two characters

   Enter a target, program, repository, branch, or SHA fragment appropriate to the active feed.
2. ### Set scope-state options

   For target feeds, include Removed targets, Not eligible for bounty, or Out-of-scope targets only when you need them.
3. ### Set intelligence filters

   Choose a minimum Target Opportunity Score, one opportunity label, and one dupe-risk level. Low dupe risk is the least crowded estimate.
4. ### Narrow by profile

   Select platforms, tags, and languages. Different filter groups combine, so each active group must match.
5. ### Reset when finished

   Use **Reset filters** to return to the default feed.

The opportunity-label choices are Elite Target, Strong Target, Potential Target, and Normal.

The same score, label, and dupe-risk controls also apply on the Commits tab by using the program targets linked to each repository event.

Tip

Use either a label or a minimum score when you want a broad threshold. Combining both is stricter: every result must satisfy both selections.

<a id="export-changes"></a>

## [Export the current page](https://bbradar.io/docs/pro/latest-changes.md#export-changes)

1. ### Filter the target feed

   Set the tab, search, and filters before choosing what to export.
2. ### Choose 5, 10, or 50 targets

   The selector limits the unique target identities taken from the currently loaded page.
3. ### Copy or download

   Select **Copy targets** or **Download .txt**.

This is not a bulk dump of all historical events. Repository changes do not currently have an export control.

<a id="feed-safety"></a>

## [Understand missing changes](https://bbradar.io/docs/pro/latest-changes.md#feed-safety)

Latest Targets focuses on confirmed, meaningful scope changes. Routine corrections, incomplete updates, and changes that have not been confirmed may not appear.

For a timeline of one program’s recorded scope, rewards and supported policy changes, open its **History** tab. [Program History](https://bbradar.io/docs/pro/program-history.md) combines recorded changes with earlier public updates where available. Its coverage is separate from this feed.

Note

If you expect a change and do not see it, check the program’s official scope source before acting.

---

# Monitor repository changes | bbradar.io

> Follow repository updates connected to bounty targets, filter by target intelligence, and open source-provider views.

Source: [https://bbradar.io/docs/pro/repository-changes](https://bbradar.io/docs/pro/repository-changes)

<a id="how-monitoring-works"></a>

## [Understand repository changes](https://bbradar.io/docs/pro/repository-changes.md#how-monitoring-works)

When an in-scope target links to a supported repository and branch, later branch updates can appear in the Commits feed. Supported sources include GitHub repositories and Gists, GitLab, Bitbucket, Gitea, Forgejo, SourceHut, and selected HTTPS Git hosts. The first observation establishes the starting point and does not appear as a change.

Sanitized product view

Repository changes

Supported repository branch updates

Pro

example/research-demo

main · Acme Cloud · GitHub scope target

Observed today

4af2c1e91bd7aa

Mapped target · 82/100Strong TargetLow dupe risk

Open provider comparison

Repository event with mapped-target opportunity and dupe-risk context. Example data and credentials are fictional or redacted; named product controls match the interface.

<a id="commits-feed"></a>

## [Use the Commits feed](https://bbradar.io/docs/pro/repository-changes.md#commits-feed)

1. ### Open Latest Targets

   Select the **Commits** tab.
2. ### Inspect the mapping

   Review the bounty program, source target, repository, branch, observation date, and before/after SHA.
3. ### Open the repository host

   Use the provider-specific compare link, or a commit link when no prior SHA is available, to inspect the change at its source.

Use the shared filters to narrow repository events by platform, tags, language, minimum target score, target opportunity label, or dupe risk. These target-level controls inspect the program target mapped to the repository event.

The browser refreshes the repository feed about once per minute only while the tab is active and the document is visible.

<a id="repository-alerts"></a>

## [Enable repository alerts](https://bbradar.io/docs/pro/repository-changes.md#repository-alerts)

1. ### Open Notification Rules

   Repository alerts use the private Telegram rule, so connect Telegram first and open [Notification Rules](https://bbradar.io/account/notifications).
2. ### Enable Repository changes

   Turn on the explicit **Repository changes** stream. It starts disabled for new rules.
3. ### Choose the match mode

   Use Everything to receive every eligible repository event, or Filtered to apply the profile and opportunity controls below.
4. ### Add optional filters

   Filter by platform, parent-program opportunity, minimum target score, target opportunity label, dupe risk, scope, language, target type, reward, submission fee, program, or target pattern.
5. ### Select Save Rules

   Wait for the saved confirmation. Merely enabling the draft toggle does not change delivery.

A repository can be linked to more than one program target. An alert is included when at least one linked target matches your saved rule. Platform, reward, and parent-program opportunity filters still apply.

Repository events appear in the Commits feed first. Discord and opted-in Telegram notifications are grouped into hourly digests to reduce repeated alerts.

Note

Repository changes are available through the browser Commits feed, the read-only Pro API, notifications, and `get_repository_changes` in MCP 0.2.3. That package’s compact projections do not expose every newer repository-quality field; use the HTTP API when those details are required.

[Enable repository alertsTurn on Repository changes, review filters, and save the rule.](https://bbradar.io/account/notifications)

<a id="privacy-retention"></a>

## [What bbradar stores](https://bbradar.io/docs/pro/repository-changes.md#privacy-retention)

bbradar keeps the repository, branch or reference, before/after SHA, observation time, program links, and evidence quality needed to show an event. It does not retain code patches, diffs, source files, commit messages, changed paths, or addition/deletion details.

Accepted repository reference changes can also appear in the program’s [History tab](https://bbradar.io/docs/pro/program-history.md). That timeline retains the same limited reference information; code review happens on the repository provider.

A confirmed scope match has supporting evidence. When a comparison is incomplete and no scoped change can be confirmed, the update is labelled “scope impact unverified.” Historical events without recorded evidence quality remain unknown. A repository update does not establish permission to test.

Discord and Telegram therefore link you to the repository provider for inspection instead of embedding code-change content.

<a id="coverage"></a>

## [Coverage and limitations](https://bbradar.io/docs/pro/repository-changes.md#coverage)

- Supported public repositories include GitHub and Gists, GitLab, Bitbucket, Gitea, Forgejo, SourceHut, and selected HTTPS Git hosts
- Active branch updates can appear in the Commits feed
- Tags and pinned commits are fixed references and do not produce later change alerts
- The first observation establishes a starting point without creating an alert
- Private or inaccessible repositories may not have change coverage

Coverage for self-managed repository hosts depends on whether that host is supported and publicly accessible.

---

# Manage your account and billing | bbradar.io

> Manage your Pro plan, invoices, cancellation, integrations, and API key from one account page.

Source: [https://bbradar.io/docs/account-and-billing](https://bbradar.io/docs/account-and-billing)

<a id="account-access"></a>

## [Account access](https://bbradar.io/docs/account-and-billing.md#account-access)

1. ### Select Sign in

   Use **Sign in with Google**. Discord is not a bbradar login method.
2. ### Open Account & Billing

   Use the account menu or the direct link below after Google returns you to bbradar.
3. ### Check Subscription

   Confirm the plan and status before changing billing or troubleshooting a Pro integration. Use **Refresh status** after a recent checkout.
4. ### Open the relevant card

   The page contains Billing, Pro API Key, Notification Rules, Telegram alerts, the bbradar MCP Server, and Discord access.

Sanitized product view

Account & Billing

Set up your Pro workspace

Pro

Subscription

Pro active

Telegram

Connect

Notification rules

Review

API & MCP

Create key

Account setup checklist with Pro access active. Example data and credentials are fictional or redacted; named product controls match the interface.

[Open Account & BillingManage subscription status, credentials, alerts, and integrations.](https://bbradar.io/account)

Note

Discord is a connected Pro integration and role assignment flow. It cannot be used to sign in to bbradar.

<a id="plans"></a>

## [Plans and billing](https://bbradar.io/docs/account-and-billing.md#plans)

| Plan | Price | Features |
| --- | --- | --- |
| Yearly | €89/year | All current Pro features, with 17.5% savings versus monthly. |
| Monthly | €8.99/month | All current Pro features. |

Checkout and subscription management are handled by Stripe. Prices shown here should match the live Pro page and checkout before you confirm payment.

<a id="billing-portal"></a>

## [Use the billing portal](https://bbradar.io/docs/account-and-billing.md#billing-portal)

1. ### Open Account & Billing

   Scroll to the **Billing** card beneath Subscription.
2. ### Select Manage billing

   bbradar opens the Stripe customer portal for the subscription attached to your account.
3. ### Make one intended change

   View invoices, update the payment method, switch an eligible plan, or cancel from Stripe.
4. ### Return and refresh

   Return to bbradar and select **Refresh status** to confirm the current plan and access state.

Important

Do not start a second checkout just because a recent Stripe change has not appeared immediately. Refresh the account status first.

<a id="cancellation"></a>

## [Cancellation and access](https://bbradar.io/docs/account-and-billing.md#cancellation)

When a paid subscription is canceled, Pro normally remains active through the end of the already-paid billing period. After access expires, private Pro data and delivery stop, and the Discord Pro role can be removed.

Read the [Payment Policy](https://bbradar.io/payment-policy.md) for billing, renewal, cancellation, and refund terms.

<a id="account-security"></a>

## [Account security](https://bbradar.io/docs/account-and-billing.md#account-security)

- Keep your Google account protected with strong authentication
- Never share API keys, connection links, or OAuth callbacks
- Regenerate a key immediately if exposure is possible
- Disconnect Telegram before transferring a chat or account
- Review active billing and integration status periodically

Security

Support does not need your API key, Google session cookie, Stripe credentials, Telegram start token, or Discord OAuth token.

---

# Troubleshoot Pro setup | bbradar.io

> Resolve common Telegram rule, opportunity-filter, Discord, MCP, API, billing, program History, target-feed and repository issues.

Source: [https://bbradar.io/docs/troubleshooting](https://bbradar.io/docs/troubleshooting)

<a id="quick-checks"></a>

## [Quick checks](https://bbradar.io/docs/troubleshooting.md#quick-checks)

1. ### Confirm Pro is active

   Open Account & Billing and verify the subscription status before debugging an integration.
2. ### Refresh once

   Reload the account page or use the integration Refresh action after completing an external flow.
3. ### Use the newest credential

   Old Telegram links and regenerated API keys stop working immediately.
4. ### Check the exact feature boundary

   Repository changes are in the Commits feed, the read-only Pro API, supported notifications, and get_repository_changes in MCP 0.2.3. Self-Hosted repository monitoring remains unavailable.

<a id="telegram-issues"></a>

## [Telegram issues](https://bbradar.io/docs/troubleshooting.md#telegram-issues)

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| I cannot find the bot | Telegram search can show similar display names. | Open the verified [@bbradario_bot link](https://t.me/bbradario_bot) and confirm the exact username. |
| Pressing Start only shows setup help | The bot was opened without the account-generated token. | Return to Account & Billing and select Connect Telegram so bbradar opens the tokenized link. |
| Start link says it is invalid or does nothing | The single-use token expired or a newer link replaced it. | Return to Account & Billing, select Connect Telegram or Reconnect, and use the newest link within about 10 minutes. |
| Status remains Not connected | Start was not pressed on the tokenized link, or the account page has not refreshed. | Press START in the @bbradario_bot private chat, wait for Telegram connected, return, and select Refresh. |
| Status is Blocked | The official bot was blocked or Telegram rejected delivery. | Unblock @bbradario_bot, then create and consume a new connection link. |
| Telegram account is already linked | That Telegram account belongs to another bbradar user. | Disconnect it from the other account or contact support. |
| Connected but no alerts arrive | Pro is inactive, streams are off, or filtered mode does not match. | Confirm Pro, integration status, enabled streams, filters, Telegram DM delivery, and that you selected Save Rules. |
| Opportunity-filtered alerts disappeared | The event lacks a selected tier, score, label, or dupe-risk value, or it fails another active filter group. | Clear the signal group back to All or Any, or broaden the selections. Remember that Unknown is separate from Low dupe risk. |

<a id="discord-issues"></a>

## [Discord issues](https://bbradar.io/docs/troubleshooting.md#discord-issues)

| Symptom | Fix |
| --- | --- |
| OAuth completes but no role appears | Join the bbradar Discord with the linked account, then select Reconnect Discord. |
| Wrong Discord account is linked | Select Connect a different Discord account and authorize the intended identity, or contact support if it cannot be replaced. |
| Role disappeared | Confirm Pro is still active; the Discord Pro role can be removed after Pro expires. |

<a id="api-mcp-issues"></a>

## [API and MCP issues](https://bbradar.io/docs/troubleshooting.md#api-mcp-issues)

| Symptom | Fix |
| --- | --- |
| MCP server will not start | Confirm Node.js 20+, run npx -y @bbradar/mcp once in a terminal, and use the Windows cmd /c fallback if needed. |
| get_mcp_status reports unauthorized | Check BBRADAR_API_KEY, ensure the key was not regenerated or deleted, and confirm Pro is active. |
| API returns 401 | Send the current full secret as an Authorization: Bearer header. |
| API returns 402 | Restore active Pro access. |
| API returns 410 | The snapshot or retained cursor expired. Restart a snapshot on page 1 or reconcile the current inventory before resuming change polling. |
| API returns 413 | Narrow the filters or page size. Snapshot results and repository associations have explicit size limits. |
| API returns 423 | Stop traffic and wait for the abuse-protection lock to expire. |
| API returns 429 | Reduce request rate and concurrency, then retry with exponential backoff and jitter. |
| API returns 503 | A required service is temporarily unavailable. Honor Retry-After when present and retry with bounded backoff. |

<a id="feed-issues"></a>

## [Feed and repository issues](https://bbradar.io/docs/troubleshooting.md#feed-issues)

| Symptom | Explanation |
| --- | --- |
| A visible upstream edit is absent | Latest Targets shows confirmed, meaningful changes. Wait for the next refresh and check the official source directly. |
| A program’s History tab is empty | Choose All history and All events. Available coverage varies by platform. |
| History access changed | Confirm that you are signed in with active Pro access, then use the displayed account refresh or retry action. |
| A new repository has no event | The first observation establishes a starting point; later branch changes can appear as events. |
| Commits did not update immediately | The browser refreshes about once per minute only while the Commits view is active and visible. |
| A supported repository target has no commits | Confirm that the target links to a supported, accessible repository and branch. Private or self-managed repositories may not have coverage. |
| A tag or pinned SHA does not change | Tags and pinned commits are fixed references, so they do not produce later branch-change events. |

[Explore Program HistoryChoose a date range and category, then compare changes.](https://bbradar.io/docs/pro/program-history.md#read-a-change)

<a id="contact"></a>

## [Still stuck?](https://bbradar.io/docs/troubleshooting.md#contact)

Collect the page URL, approximate time, visible status or HTTP code, browser/OS, and a short description of what you expected. Do not include secrets, session cookies, Telegram start links, OAuth callbacks, or payment details.

[Contact account or billing supportEmail info@bbradar.io for private account, access, or billing questions.](mailto:info@bbradar.io)[Ask in the bbradar DiscordShare the non-sensitive context needed to reproduce the issue.](https://discord.gg/4DAm4Gg8JC)[Read the product FAQCheck product access, data, billing, and monitoring boundaries.](https://bbradar.io/docs/faq.md)

---

# bbradar Pro: Program History, Targets & Alerts

> Spot scope and reward changes with Pro activity labels, compare Program History, explore full targets and Self-Hosted programs, and get personal alerts.

Source: [https://bbradar.io/pro](https://bbradar.io/pro)

bbradar Pro

Research intelligence across 25 platforms

Spot expanding scope and changing rewards, see the full story in Program History, and get personal alerts for the targets you follow.

Activity labels + Program HistoryFull targets and score breakdownsVerified Self-Hosted catalogPersonal Telegram alerts

## Choose your billing

Cancel anytime

Billing plan

YearlyBest value€89/year€7.42/month equivalent, billed annuallySave 17.5% vs monthlyMonthly€8.99/monthBilled monthly

I agree to the [Terms of Service](https://bbradar.io/terms-of-service.md) and [Payment Policy](https://bbradar.io/payment-policy.md).

<a id=":Rlea:-next-step"></a>

Sign in with Google, then complete your purchase with Stripe.

Renews annually until canceled. No free trial. Access continues through the paid period if you cancel. Taxes may apply at checkout.

Secure Stripe checkoutCancel anytime

[Explore every feature](https://bbradar.io/pro.md#features)[Compare Free and Pro](https://bbradar.io/pro.md#comparison)[Pricing](https://bbradar.io/pro.md#pricing)

Illustrative program detail · demo data

## Example Bug Bounty Program

Bug Bounty program

VisitVisit Program

Rewards

$0–$10,000

Platform

HackerOne

Added

Sep 1, 2026

Scope

Web + API

Reports

19

Targets

42

Recent changes

12

Recent activityScope expandedRewards increased

OverviewTargetsHistory

### Latest changes

Example snapshot · Sep 7, 2026

View History

Rewards increased

Maximum bounty raised from $5,000 to $10,000

Today

Scope expanded

api.example.com added to scope

Yesterday

Program rules updated

Reporting guidelines changed

Sep 5

25 platforms

plus the company-run Self-Hosted catalog

350+ paid programs

Self-Hosted · 450+ VDPs · September 2026 snapshot

5 surfaces

Web · Telegram · Discord · API · MCP

Scores with reasons

opportunity, competition and dupe-risk factors

<a id="features"></a>

What Pro adds

## Find the opportunity, understand the target, act sooner

Find programs worth a closer look, see what changed, and keep up with the targets you care about.

01 · Follow what changes

## New scope, changed rewards and the context behind them

Spot fresh opportunities and important changes in the list, then open a program for the full story.

### Program History

See how a program has changed before you decide where to spend your research time.

- Scope, rewards, rules and program updates in one timeline
- Before-and-after details you can compare
- Filters to find the changes that matter to you
- Source links to explore further

[Explore Program History](https://bbradar.io/docs/pro/program-history.md)

### Program lifecycle alerts

Follow opportunities from first discovery through later status changes.

- New and upcoming programs
- Previously discovered programs
- Suspended and reactivated status changes
- Source URLs and update timestamps

[Explore alert streams](https://bbradar.io/docs/notifications.md)

### Program Opportunity Scores

Prioritize programs using a consistent score, tier and supporting context.

- Elite, Hot, Strong and Potential tiers
- Clear reasons behind each score
- Report counts where available
- Submission costs and cost sorting

[Find promising programs](https://bbradar.io/docs/pro/discovery.md#methodology)

### Program activity at a glance

Find growing opportunities and catch changes that could affect your next hunt.

- Scope expanded or reduced, rewards increased or decreased
- High activity, recent updates and large scope changes
- Sort by recent updates, activity or the largest scope changes
- Open History straight from a label

[Explore activity labels](https://bbradar.io/docs/pro/program-history.md#activity-labels)

### Company-run programs

Explore company-run bug bounties, from Apple and Microsoft to banks and exchanges. Our September 2026 catalog snapshot includes 350+ paid programs.

- Paid programs and optional VDPs
- Official reporting routes and policies
- Reward ranges, votes, reward types and scope filters
- Separate new-program alert streams

[Explore company-run programs](https://bbradar.io/docs/pro/self-hosted.md)

### Repository changes

See when supported public repositories found in program scope change.

- Repositories mapped back to affected programs
- Updates after monitoring begins
- Open comparisons on the source provider

[Explore repository changes](https://bbradar.io/docs/pro/repository-changes.md#coverage)

02 · Pick better targets

## Know which targets deserve your research time

Review available targets and changes, then use Target Intelligence to compare opportunity and estimated competition before choosing where to research. Platform-reported submission fees or deposits stay visible on each Latest Targets card.

Target Opportunity Score

Score, label and factor breakdown for supported targets.

Scope change types

Added, re-added, updated and removed target events.

Advanced exploration

Search and filter by platform, tag, language, type, state, score, label and risk.

Copy and export

Copy one target or export filtered/current results as .txt in 5, 10 or 50 rows.

Why This Target + estimated dupe/competition risk

Compare targets by opportunity and estimated competition, with a short explanation to help you decide where to start.

[Explore Target Intelligence](https://bbradar.io/docs/pro/program-targets.md#intelligence)

Target change explorer

Illustrative data · 7 Sep 2026 · UTC

Demo

Platform Target type Min score Risk Status

Addedapi.example.com09:02

Updated*.cdn.example.com08:46

Re-addedmobile-api.example.com08:04

Removedlegacy.example.com06:04

Commitsgithub.com/example/contracts05:04

5 example events Export .txt

### An example research workflow

1. Find the example API addition in the change explorer.
2. Review its score factors, then confirm scope and reporting rules on the official program page.
3. Save a Telegram rule for the programs and target types you follow.

[Follow the illustrated walkthrough](https://bbradar.io/docs/pro/discovery.md#example-walkthrough)

03 · Receive and automate

## Use Pro where your research already happens

Create personal alert rules, use shared community channels, or integrate the data into your own tools and AI workflows.

### Personal notification rules

Control what reaches your private Telegram DM while using the web feeds for interactive research.

Event streamsSelf-Hosted paid + VDPRepository changesPlatformsScope tagsLanguagesTarget typesBounty min/maxInclude programsExclude programsInclude targetsExclude targetsNew scope only

[Build your first Telegram rule](https://bbradar.io/docs/notifications/rules.md)

### Developer access included

Use the same opportunity data outside the web app.

GET /api/v1/pro/opportunities/{level}

Connect program, target and change data to your research tools.

[Read API limits and examples](https://bbradar.io/docs/api.md#limits)

npx -y @bbradar/mcp

Local STDIO MCP server for compatible AI clients. Node.js 20+.

[Connect your AI client](https://bbradar.io/docs/mcp.md)

### Web

Spot activity in the program list, review scope and rewards in Overview, then open History for the changes behind them.

[Web guide](https://bbradar.io/docs/pro/discovery.md)

### Telegram

Private one-to-one alerts filtered by your own notification rules.

[Telegram guide](https://bbradar.io/docs/notifications/telegram.md)

### Discord

Shared Pro role and channels for community updates; personal rules do not control Discord delivery.

[Discord guide](https://bbradar.io/docs/notifications/discord.md)

### API

Bring programs, opportunities, targets, submission costs and change feeds into your own tools.

[API guide](https://bbradar.io/docs/api.md)

### MCP

Research programs and targets in your favorite compatible AI tools with @bbradar/mcp.

[MCP guide](https://bbradar.io/docs/mcp.md)

<a id="comparison"></a>

## Free discovery, Pro research intelligence

Discover programs for free. Get activity labels, full History, target research tools and personal alerts with Pro.

| Feature | Free | Pro |
| --- | --- | --- |
| Programs aggregated across 25 platforms | Included | Included |
| Core program search and filters | Included | Included |
| Verified Self-Hosted paid programs and VDP catalog | Not included | Included |
| New, upcoming and lifecycle alerts | Not included | Included |
| Report counts, opportunity scores and tiers | Not included | Included |
| Submission costs in listings, target changes and sorting | Not included | Included |
| Full targets, search and change explorer | Not included | Included |
| Activity labels and sorting | Not included | Included |
| Program History with before-and-after details | Not included | Included |
| Repository monitoring + provider links | Not included | Included |
| Target score, dupe risk and Why This Target | Not included | Included |
| Copy and .txt export actions | Not included | Included |
| Private Telegram rules + shared Discord access | Not included | Included |
| Pro API and local MCP server | Not included | Included |

Start with the public program overview. Pro adds activity labels, recent changes and the full History timeline.

<a id="pricing"></a>

One Pro plan · two billing options

## Get Pro. Choose your billing.

Every Pro feature is included on monthly and yearly billing. Yearly saves 17.5% versus monthly.

- Full targets + scores
- Activity labels + History
- Self-Hosted catalog
- Alerts, API + MCP

## Choose your billing

Cancel anytime

Billing plan

YearlyBest value€89/year€7.42/month equivalent, billed annuallySave 17.5% vs monthlyMonthly€8.99/monthBilled monthly

I agree to the [Terms of Service](https://bbradar.io/terms-of-service.md) and [Payment Policy](https://bbradar.io/payment-policy.md).

<a id=":Rd2:-next-step"></a>

Sign in with Google, then complete your purchase with Stripe.

Renews annually until canceled. No free trial. Access continues through the paid period if you cancel. Taxes may apply at checkout.

Secure Stripe checkoutCancel anytime

Secure payments powered by Stripe. VAT is handled by Stripe where applicable. By subscribing you agree to the [Payment Policy](https://bbradar.io/payment-policy.md) and [Terms of Service](https://bbradar.io/terms-of-service.md). Cancel anytime from your account; access remains active through the paid period.

<a id="faq"></a>

Questions, answered

## Pro FAQ

Get started with activity labels, History, target research, alerts and more.

<a id="pro-faq-getting-started"></a>

How do I get started after subscribing?

Start with the program list and sort by recent updates or activity. Open a program to review its overview, targets and History, then connect Telegram for personal alerts.

[Read the setup checklist](https://bbradar.io/docs/getting-started.md)

<a id="pro-faq-platforms"></a>

Does Pro include all 25 platforms?

Yes. Pro builds on bbradar’s 25-platform catalog with activity labels, Program History, reports, fees, target research tools and alerts. You also get the separate Self-Hosted catalog of company-run programs.

[View supported platforms](https://bbradar.io/platforms)

<a id="pro-faq-self-hosted"></a>

How does the Self-Hosted catalog work?

Find bug bounty programs published on companies’ own websites, with rewards, scope, official policies and reporting links in one place. Browse paid programs or include VDPs, and get alerts for newly listed programs.

[Explore company-run programs](https://bbradar.io/docs/pro/self-hosted.md)

<a id="pro-faq-program-history"></a>

Where can I find Program History?

Open a program and choose History beside Overview and Targets. You can also click an activity label in the program list to go straight to History. Pro gives you the full timeline, filters and before-and-after details.

[Explore Program History](https://bbradar.io/docs/pro/program-history.md#open-history)

<a id="pro-faq-activity-labels"></a>

What do the activity labels show?

They highlight expanding or shrinking scope, rewards going up or down, large scope changes and active or recently updated programs. Scan them in the program list or on a program’s details page, then open History for a closer look.

[Explore activity labels](https://bbradar.io/docs/pro/program-history.md#activity-labels)

<a id="pro-faq-activity-sorting"></a>

Can I sort programs by activity?

Yes. With Pro, sort the program list by Recently updated, Most active or Largest scope change to find programs worth another look.

<a id="pro-faq-history-coverage"></a>

What can I review in Program History?

Review scope changes, rewards, rules, program updates and repository activity in one timeline. Filter by change type, compare the details, and follow links to the source.

[See the changes you can follow](https://bbradar.io/docs/pro/program-history.md#change-coverage)

<a id="pro-faq-freshness"></a>

How fresh are the updates?

bbradar regularly checks programs and scope for updates. Use Recently updated sorting and the dates in History to find the latest changes, or get alerts for the programs and targets you follow.

[Find recent opportunities](https://bbradar.io/docs/pro/discovery.md#methodology)

<a id="pro-faq-scores"></a>

What do the opportunity and dupe-risk scores mean?

They help you compare opportunities and decide where to spend your research time. Pro adds score breakdowns, estimated competition and a “Why This Target” explanation. In the program list, the report-count badge also shows dupe risk through its color and icon.

[Explore Target Intelligence](https://bbradar.io/docs/pro/program-targets.md#intelligence)

<a id="pro-faq-delivery-channels"></a>

How are Telegram and Discord different?

Telegram is a private one-to-one delivery channel that uses your personal notification rules. Discord provides shared Pro roles and channels; personal rules do not customize the shared Discord feed.

<a id="pro-faq-filters-and-exports"></a>

What can I filter and export?

The target explorer supports search plus platform, tag, language, target type, eligibility/scope/removal state, minimum score, label and risk filters. You can copy individual targets or export filtered/current results to .txt, including 5, 10 or 50-row page sizes.

<a id="pro-faq-repository-monitoring"></a>

What is included in repository monitoring?

Follow updates to supported public repositories in program scope. See which programs are affected, open a comparison on the repository provider, and receive alerts when changes are found.

[Explore repository changes](https://bbradar.io/docs/pro/repository-changes.md#coverage)

<a id="pro-faq-api-and-mcp"></a>

What is included with API and MCP access?

Both billing options include API keys and @bbradar/mcp. Bring program, opportunity, target and repository-feed data into your own scripts and compatible AI tools.

[Explore API access](https://bbradar.io/docs/api.md)

<a id="pro-faq-trial-and-refunds"></a>

Is there a free trial or a refund for unused time?

There is no free trial. Subscriptions renew automatically until canceled. Payments are not refunded for partial periods or unused time, except where required by law. You can read the public guides and illustrative previews before subscribing.

[Read the Payment Policy](https://bbradar.io/payment-policy.md)

<a id="pro-faq-cancellation"></a>

Can I cancel at any time?

Yes. You can cancel from your account at any time, and access remains active through the paid billing period. Checkout is securely handled by Stripe, with VAT handled by Stripe where applicable.

Start today

## Find your next target with Pro.

Start with yearly billing for the best value, or stay flexible month to month. Both include every Pro feature.

Best value · Save 17.5% vs monthly

Flexible monthly billing

Secure Stripe checkoutCancel anytime

---

# About bbradar.io | Bug Bounty Intelligence

> Find bug bounty opportunities across 25 platforms with bbradar.io. Explore Pro activity labels, Program History, Self-Hosted programs and personal alerts.

Source: [https://bbradar.io/about](https://bbradar.io/about)

[](https://x.com/Kle0z)[kle0z](https://x.com/Kle0z)

Hello frens,

bbradar.io began because I was tired of checking every bug bounty platform separately for new programs. It has grown into a security research intelligence service that brings public programs from 25 supported platforms into one radar, tracks material scope and repository movement, and helps researchers compare the signals that matter before choosing where to spend their time.

## Platform coverage

- [HackerOne](https://bbradar.io/platforms/hackerone)
- [BugCrowd](https://bbradar.io/platforms/bugcrowd)
- [Intigriti](https://bbradar.io/platforms/intigriti)
- [Immunefi](https://bbradar.io/platforms/immunefi)
- [HackenProof](https://bbradar.io/platforms/hackenproof)
- [YesWeHack](https://bbradar.io/platforms/yeswehack)
- [Standoff365](https://bbradar.io/platforms/standoff365)
- [BI.ZONE](https://bbradar.io/platforms/bi-zone)
- [Code4rena](https://bbradar.io/platforms/code4rena)
- [Sherlock](https://bbradar.io/platforms/sherlock)
- [CodeHawks](https://bbradar.io/platforms/codehawks)
- [Cantina](https://bbradar.io/platforms/cantina)
- [Bugbase](https://bbradar.io/platforms/bugbase)
- [BugRap](https://bbradar.io/platforms/bugrap)
- [IssueHunt](https://bbradar.io/platforms/issuehunt)
- [Inspectiv](https://bbradar.io/platforms/inspectiv)
- [Bug Bounty Switzerland](https://bbradar.io/platforms/bug-bounty-switzerland)
- [AuditOne](https://bbradar.io/platforms/auditone)
- [CertiK](https://bbradar.io/platforms/certik)
- [Huntr](https://bbradar.io/platforms/huntr)
- [Remedy](https://bbradar.io/platforms/remedy)
- [Compass Security](https://bbradar.io/platforms/compass-security)
- [GObugfree](https://bbradar.io/platforms/gobugfree)
- [PatchDay](https://bbradar.io/platforms/patchday)
- [HackZar](https://bbradar.io/platforms/hackzar)

Programs operated directly by organizations live in the separate [verified Self-Hosted Pro catalog](https://bbradar.io/self-hosted), where you can review rewards, reporting routes, and available scope in one place. Pro also adds target identities and opportunity signals, scope and repository alerts, Telegram rules, and API and MCP access for platform and Self-Hosted program data.

Spot new scope, reward changes and busy programs with Pro activity labels. Sort by recent updates, high activity or the largest scope changes to find your next program. Open its Overview for a quick catch-up, then use [History](https://bbradar.io/docs/pro/program-history.md) to compare what changed before choosing a target.

Coverage keeps expanding. If there is a platform I've missed and you want to see it on bbradar.io, drop me a DM on [𝕏](https://x.com/Kle0z).

Stay tuned & Happy hunting !

---

# Submit or Correct a Bug Bounty Listing | bbradar.io

> Suggest a public bug bounty program, platform, or security event, or request a listing correction. Share official policy and scope evidence with bbradar.io.

Source: [https://bbradar.io/get-listed](https://bbradar.io/get-listed)

Suggest a public bug bounty program, a platform, or a security event. You can also report outdated rewards, scope, reporting links, or program status on an existing listing.

<a id="what-to-send"></a>

## What to send

- The organization or platform name and its official website.
- A first-party program policy with scope, testing rules, and the official reporting route.
- Published reward information, any submission fee, and dates for time-limited events.
- For corrections, the bbradar listing URL, the field that needs changing, and an official source showing the current information.

A company-run program can be considered for the verified Self-Hosted catalog. We review official evidence before admitting a program; a reporting email or security.txt alone is not enough.

<a id="contact"></a>

## Send a listing or correction request

Email the details and public source links. Avoid including private vulnerability reports or credentials.

[Email info@bbradar.io](mailto:info@bbradar.io?subject=Bug%20bounty%20listing%20or%20correction)

You can also [contact @Kle0z on X](https://x.com/Kle0z). Inclusion depends on the available evidence and supported sources.

A bbradar listing helps you discover a program. Its official policy determines whether and how you may test. Learn more about our [data and signal methodology](https://bbradar.io/docs/pro/discovery.md#methodology).

---

# Cookie Policy | bbradar.io

> Learn how bbradar.io uses cookies and similar technologies, what data we collect, and how you can manage your preferences.

Source: [https://bbradar.io/cookie-policy](https://bbradar.io/cookie-policy)

This Cookie Policy explains how bbradar.io ("we", "us", or "our") uses cookies and similar technologies to recognize you when you visit our website. It explains what these technologies are, why we use them, and your rights to control our use of them.

## What are cookies?

Cookies are small text files that are stored on your device by your web browser. They help websites remember your preferences, login details, and how you interact with the site. Cookies can be "first-party" (set by us) or "third-party" (set by others, like analytics providers).

## Types of cookies we use

- **Essential cookies:** Required for basic site functionality, such as session management, security (CSRF protection), and remembering your cookie consent. These cannot be disabled.
- **Analytics cookies (Google Analytics):** Help us understand how visitors use our site, so we can improve it. These cookies collect information in an anonymous form, including the number of visitors, where they came from, and the pages they visited. We use Google Analytics for this purpose.
- **Preference cookies:** Remember your settings and preferences (such as theme or language) to provide a more personalized experience.

## Why we use cookies

We use cookies to:

- Ensure the website functions properly and securely
- Analyze site usage and improve our services
- Remember your preferences and settings

## Cookies we use

| Cookie Name | Type | Provider | Purpose | Duration |
| --- | --- | --- | --- | --- |
| session_id | Essential | First-party (bbradar.io) | Maintains user session and security (e.g., CSRF protection) | 1 hour |
| csrf_token | Essential | First-party (bbradar.io) | Prevents cross-site request forgery attacks | Session |
| _ga | Analytics | Google Analytics | Tracks site usage and visitor behavior | 2 years |
| _gid | Analytics | Google Analytics | Tracks site usage and visitor behavior | 24 hours |

## Third-party cookies

Some cookies are set by third-party services we use, such as Google Analytics. These third parties may use cookies to collect information about your online activities over time and across different websites. We do not control these cookies. For more information, see the privacy policy of the relevant third party.

## How to manage cookies

You can control and delete cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling essential cookies may affect the functionality of this site. For more information, see your browser's help section.

## Data sharing and privacy

We do not sell or share your personal data with third parties for marketing purposes. Data collected via cookies is used only for the purposes described above. Google Analytics data may be transferred outside your country, subject to their privacy policy.

## Contact us

If you have any questions about our use of cookies or this policy, please contact us at [info@bbradar.io](mailto:info@bbradar.io).

Last updated: January 2026

---

# Payment Policy | bbradar.io

> Details on billing, renewals, cancellations, and refunds for bbradar Pro subscriptions.

Source: [https://bbradar.io/payment-policy](https://bbradar.io/payment-policy)

This Payment Policy explains how billing works for bbradar Pro subscriptions. By purchasing a plan, you agree to this policy and the [Terms of Service](https://bbradar.io/terms-of-service.md).

## Billing and renewal

Subscriptions are billed in EUR and renew automatically each month or year until canceled. You can cancel at any time from your account. When the current period is paid, access continues through its end. If payment is past due when you cancel, subscription-based access ends immediately and we stop automatic attempts on outstanding subscription invoices. An unpaid invoice can remain open for separate review.

## No refunds

All payments are final. We do not offer refunds or credits for partial periods or unused time, except where required by law.

## EU/EEA withdrawal rights

If you are in the EU/EEA, you may have a 14-day right to withdraw from a distance purchase. By starting a Pro subscription, you request immediate access to Pro features and understand this may affect withdrawal rights where applicable. Once access begins, your right of withdrawal may be lost or reduced for that billing period as permitted by law. Where a refund is required by law, we will process it.

## Trials and promotions

We do not offer free trials or promotional pricing at this time.

## Payment failures

If a payment fails, we may retry the charge until you cancel or collection is stopped. Access to Pro features can be paused until payment is successful.

## Taxes and fees

Prices are listed in EUR. VAT or other taxes may apply based on your location and are handled by Stripe where applicable.

## Chargebacks and abuse

Chargebacks or suspected fraud may result in immediate suspension of your account and access to Pro features.

## Contact

Questions about billing? Contact us at [info@bbradar.io](mailto:info@bbradar.io).

Last updated: January 2026

---

# Terms of Service | bbradar.io

> Terms of Service for using bbradar.io, including account responsibilities and limitation of liability.

Source: [https://bbradar.io/terms-of-service](https://bbradar.io/terms-of-service)

These Terms govern your access to and use of bbradar.io. By using the site, you agree to these Terms.

## Service overview

bbradar.io provides an index of public bug bounty programs and related data. We do not operate or control the programs listed on the site.

## Accounts

You are responsible for maintaining the confidentiality of your account and for all activity that occurs under it.

## Subscriptions

Paid subscriptions are subject to our [Payment Policy](https://bbradar.io/payment-policy.md). By subscribing, you request immediate access to Pro features and understand this may affect withdrawal rights where applicable. No refunds are provided except where required by law.

## Acceptable use

- Do not abuse, disrupt, or attempt to compromise the site or its services.
- Do not misuse data in violation of applicable laws or program rules.
- Do not attempt to reverse engineer or circumvent access controls.

## Third-party content

Links to third-party programs and platforms are provided for convenience. We do not endorse or guarantee their accuracy, availability, or reward outcomes.

## No warranties

The service is provided "as is" and "as available" without warranties of any kind.

## Limitation of liability

To the maximum extent permitted by law, bbradar.io and its operators are not liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or revenue. Our total liability is limited to the amount you paid in the 12 months before the claim.

## Termination

We may suspend or terminate access to the service if we believe you have violated these Terms.

## Changes to these Terms

We may update these Terms from time to time. Continued use of the service after changes means you accept the updated Terms.

## Contact

Questions about these Terms? Contact us at [info@bbradar.io](mailto:info@bbradar.io).

Last updated: January 2026