lissy93/bug-bounties: A Directory of Disclosure Programs, With an MCP and API Attached
⚔️ Community maintained directory, MCP and API of 3,000+ active bug bounty programs and VDPs
At a glance
- What is it?
- The repository compiles 3,000+ bug bounty programs and vulnerability disclosure policies into a browsable site, an MCP server and an API. The hard part is not the list, it is keeping contact pages and payout flags current, and the README does not explain how that is done.
- Who is it for?
- Adopt it if you need a machine-readable starting point for disclosure targets and you are willing to verify each entry against the company's own policy page before sending anything. Do not adopt it as a compliance record or as evidence that a program still pays: the README shows payout markers and links, not last-verified dates.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 1 day ago.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The Problem: Finding Who Accepts Reports, Not Just Who Has a Security Page
Security researchers face a boring lookup problem. A company may run a program on HackerOne, Bugcrowd, Intigriti, YesWeHack or Immunefi, or it may publish a responsible disclosure policy on its own domain with no platform at all. The README's own framing is "A compiled list of companies who accept responsible disclosure," and the entries bear that out: AAVE points at immunefi.com, Accellion at bugcrowd.com, Adobe Public at intigriti.com, Alasco GmbH at yeswehack.com, and Abn Amro at a page on abnamro.nl. Four platforms plus self-hosted policies, mixed in one alphabetical list. The intended user is someone deciding where to send a finding, or an automation that needs a target list. The repository is not a scanner and not a report tracker. It answers one question: does this organization have a channel, and what kind?
What the Entries Actually Contain, and What the Payout Markers Do Not Say
Each line carries a favicon pulled from icon.horse, a company name, a link, and zero or more of three markers defined in the README key: a money bag for bounty, a medal for shout-out, and a gift for swag. Ably is marked bounty and shout-out. Achmea is marked swag only. Acquia is marked shout-out only. That three-way split is more useful than a binary paid or unpaid flag, because a VDP with swag is still worth a researcher's afternoon in a way that a policy with no recognition is not. The limitation is that the markers describe the program's stated offer, not its behaviour. Nothing in the supplied material shows a last-checked date, a response-time field, or a record of whether a listed program has since closed. A directory of this kind decays, and the README does not document the decay rate or the verification cadence.
Data Flow: README Markers, a Generated Block, and a Separate Site
The README contains an HTML comment pair, bounties-start and presumably a matching end marker, wrapping the program list. That pattern is a generation boundary: tooling writes the list between the markers, and the surrounding prose stays hand-written. The same list is rendered at bug-bounties.as93.net, which the README links twice, once as "Browse All Programs" and once as the place to "View full list and details." So the repository is the source, the site is the reading surface, and the MCP server and API are the machine surfaces named in the repository description. The README does not show the intermediate schema, so how a program record is shaped before it reaches the README, the site, the API and the MCP tool is not something this review can confirm. Treat the generation markers as the one architectural fact the README does expose.
The A Section Already Shows Duplicate Records
Look at the A entries closely. Acorns Grow, Acorns Grow, Inc. and Acorns LLC all appear as separate lines, all pointing at bugcrowd.com/acorns or a near variant. Aiven appears twice: once as a link to aven.com with a bounty marker, once as "Aiven Managed Bug Bounty" on bugcrowd.com. Adobe appears twice, once on helpx.adobe.com and once as "Adobe Public" on Intigriti. Some of this is legitimate, since a company can run both a self-hosted policy and a platform program, but the Acorns rows look like the same engagement recorded under three names. For a human browsing the site this is noise. For anyone consuming the API or MCP output programmatically it is worse, because a naive dedupe by company name will miss these and a naive dedupe by URL will not catch the Adobe pair. The README gives no indication of whether the API resolves this.
Getting It Running: Submission, Not Installation
The README documents one workflow in detail: adding a program. The "Submit New Program" link points at github.com/Lissy93/bug-bounties/issues/new?template=add.yml, so contributions go through a GitHub issue form rather than a pull request against the data file. That is a deliberate choice with a real consequence. A maintainer has to transcribe the issue into whatever the canonical data store is, which adds a manual step and a latency window, but it also keeps malformed entries out of the generated README block. The README does not document a local development setup, a build command, environment variables, or how to run the MCP server or query the API. For a project whose description leads with MCP and API, that is the biggest gap in the supplied material. Anyone integrating should start from the deployed site and inspect the live endpoints rather than expect setup instructions in the repository.
Licence and the Cost of Keeping 3,000 Links Alive
The licence is MIT, which permits reuse, modification and redistribution with attribution and the licence text, and disclaims warranty. That matters for two audiences. Someone embedding the dataset in a commercial product can do so under MIT terms, though the underlying program links belong to the companies and platforms, not to this repository. Someone forking the directory to run their own version inherits the maintenance burden, which is the real cost here. Three thousand entries across four platforms and hundreds of self-hosted policy pages means link rot, program closures, platform migrations and renamed companies. The README's generated-block structure makes the mechanical update cheap, but somebody still has to notice that a program moved. With no releases retrieved and a last push dated 2026-09-09, the repository is active, but activity is not the same as per-entry verification, and the material does not let this review distinguish the two.
Where a Curated Directory Beats a Platform Search
The obvious alternative is searching each platform directly: Bugcrowd, HackerOne, Intigriti, YesWeHack, Immunefi. Those are authoritative for their own programs and will always be more current than a third-party mirror. The difference in approach is scope. A platform search only returns programs hosted on that platform, so a researcher looking for a specific company has to check each one, and a company running a self-hosted policy appears nowhere. This repository's value is the union: Abn Amro's own disclosure page sitting in the same list as Adobe's Intigriti program and AAVE's Immunefi program. The trade-off is authority. A platform's listing is the program's own record. A directory entry is a pointer, and pointers go stale. The right mental model is a starting index, not a source of truth.
Editorial conclusion
Adopt it if you need a machine-readable starting point for disclosure targets and you are willing to verify each entry against the company's own policy page before sending anything. Do not adopt it as a compliance record or as evidence that a program still pays: the README shows payout markers and links, not last-verified dates. Before wiring the API or MCP into a workflow, confirm the response schema and rate limits from the deployed instance, and check whether the program you care about appears more than once under different names, as the A section already shows with Acorns Grow, Acorns Grow, Inc. and Acorns LLC.
Community notes