DEV Community: Mr Zack

Kalshi's API is flooded with 8,000+ zero-volume parlay markets. If your scraper reads /markets, it's been empty since Sept 4.

Mr Zack — Fri, 04 Sep 2026 19:46:50 +0000

Yesterday one of my Apify Actors — a cross-platform "biggest movers" feed for Polymarket and Kalshi — ran, succeeded, and delivered 100 rows. Every single row was Polymarket. The Kalshi half of the product had silently gone to zero, and nothing in the run status said so.

Here's what happened, how I caught it, and the one query parameter that fixes it.

What changed on Kalshi

GET https://api.elections.kalshi.com/trade-api/v2/markets?status=open&limit=1000 used to return a sensible mix of open markets. Since September 4, 2026 the first pages look like this:

page 1: 1000 markets, 1000 multivariate, 0 with 24h volume
page 2: 1000 markets, 1000 multivariate, 0 with 24h volume
...
page 8: 1000 markets, 1000 multivariate, 0 with 24h volume

8,000 markets in a row, all with a ticker like KXMVECROSSCATEGORY-SHARD1-S2026…-FE61…, a mve_collection_ticker field, a 26-leg mve_selected_legs array (26 college-football moneylines chained together), volume_24h_fp: "0.00" and last_price_dollars: "0.0000". They are auto-generated multivariate ("parlay") combinations. They're valid markets, they're just not something anyone is trading, and there are thousands of them created every day.

My Actor's Kalshi loop scanned "up to 4× the requested market count" — 800 markets — and stopped. All 800 were parlay shards. Zero Kalshi rows. The Polymarket leg still worked, so the dataset was non-empty, so the run was SUCCEEDED. This is the failure mode I'm most afraid of: success-rate stays 100% while the output quietly loses half its value.

How I caught it

Not from the run status. I run a free local canary for every Actor before I look at the cloud: the production parser hit the live source from my own machine, with gates on counts and field coverage, not just exit codes. Yesterday's gate for this Actor:

PASS polymarket >=150 markets 200
FAIL kalshi >=50 markets w/ 24h vol 0 of 4000 scanned
PASS default filters -> 100 rows 100
FAIL both platforms in top 100 {"polymarket":100}

Two red lines. If I had only checked "did it succeed / did it return 100 rows", I'd have seen nothing.

The fix: `mve_filter=exclude`

Kalshi's API has an (under-documented) filter for exactly this:

GET /trade-api/v2/markets?status=open&limit=1000&mve_filter=exclude

With it, page 1 goes from 0 to 45 markets with 24-hour volume, and by page 4 you have ~600 real, actively traded markets. Ten pages (10k markets) give 2,588 open Kalshi markets with non-zero 24h volume — that's the real universe.

I also made two defensive changes so this can't recur silently:

Skip anything with mve_collection_ticker or mve_selected_legs in the normalizer, regardless of what the API returns.
Paginate by "useful markets collected", not "raw markets scanned" — keep pulling pages (cap 10) until I have at least 2× the requested top-N with volume > 0.

After the fix, the same default run returns 51 Polymarket + 49 Kalshi movers in the top 100, and the Kalshi log line says 618 markets with 24h volume fetched instead of nothing.

Note the /events?with_nested_markets=true endpoint is not flooded (0 MVE events on page 1), so if you're already on events you're fine. It's specifically /markets.

If you scrape Kalshi, check your last few days

Any pipeline built on /markets?status=open that either (a) stops after N pages or (b) filters on volume_24h > 0 after fetching, has most likely been returning a near-empty Kalshi set since Sept 4. Symptoms: dashboards with only Polymarket, arbitrage scanners with zero Kalshi pairs, "market count" charts falling off a cliff. Add mve_filter=exclude and re-run.

The Actor

The fixed feed is live: Prediction Market Movers | Polymarket & Kalshi Catalyst Feed — one ranked list of the biggest 24h odds swings, volume spikes and closing-soon markets across both platforms, each with a 0–100 catalyst score and signals like BIG_SWING, VOLUME_SPIKE, CLOSING_SOON, FAST_MOVER_1H. HTTP-only, public APIs, no keys; you pay per ranked row (~$0.01), and a default run costs about a cent. It also works as an MCP tool if you want an agent to ask "what moved on prediction markets today?"

Sibling Actors if you want the rest of the stack: Polymarket ↔ Kalshi Arbitrage Scanner, Polymarket Top Traders, Kalshi Weather Markets.

If this saved you a debugging session, a ⭐ or bookmark on the Actor page helps a lot — and if you've seen other Kalshi API changes this week, tell me in the comments so I can add gates for them.

I pulled the open positions of Polymarket's 25 most profitable traders. $7.5M is sitting in just 5 bets.

Mr Zack — Thu, 03 Sep 2026 19:33:06 +0000

Polymarket publishes a leaderboard. It also publishes every wallet's positions. Nobody joins the two, so I did — with a scraper that hits the public data-api (no login, no key) and writes one flat row per whale position.

Here is what the top 25 traders by 30-day PnL were holding this morning (September 4, 2026).

The headline numbers

25 traders, $2.03M combined 30-day profit. Median $61.5k. #1 (Sassy-Bucket) made $206k on only $203k of volume — a ~100% return; #3 (BrotherObama) needed $548k of volume for $176k.
318 open positions worth $7.53M, sitting on $980k of unrealized profit. 188 of 318 (59%) are currently green.
Average entry price 0.55, average current price 0.60. They buy at coin-flip odds and hold while the market drifts their way.
Median time to resolution: 60 days. Only 28% of positions resolve within a week. These are not scalpers.

Where the money actually is

Category	Positions	Current value
Crypto price levels ("Will BTC dip to $X by Dec 31?")	69	$4.50M
Macro (Fed rate decisions)	16	$1.11M
Sports (MLB O/U, US Open tennis)	44	$0.52M
Politics / legislation	41	$0.17M
Everything else	148	$1.24M

One wallet (JnStrtPrdctnMrkts) owns the five largest positions on the board — all of them "No" on Bitcoin/Ethereum dip markets: "ETH dips to $1,500 by Dec 31" No at $865k (entered 0.62, now 0.86, +$242k), "BTC dips to $55k" No at $589k (+$209k), "$50k" No at $552k, "$45k" No at $391k, "ETH $1,250" No at $370k. That is a $2.8M ladder betting that crypto simply does not crash this year, bought when the market priced the crash at 25–45%.

The most crowded trades

Markets where several whales independently hold the same side are the closest thing to a consensus signal:

"No change in Fed rates after the September 2026 meeting" — 5 of 25 whales, all Yes, $749k. Plus 3 whales on "No" to a 25 bps hike ($309k). The smart-money book is unanimous: nothing happens in September.
"Clarity Act (H.R.3633) signed into law in 2026?" — 3 whales, all Yes, $108k.
Sports are where they disagree: Giants–Pirates O/U 8.5 has 2 whales Over and 2 Under. Struff–Cerundolo at the US Open: 3 on Cerundolo, 2 on Struff. Sports positions are small ($5–30k) and short-dated — this looks like edge-hunting, not conviction.

What this is useful for

Copy-trading feeds: schedule the scraper hourly, diff conditionId + wallet against the previous run, and you get "whale opened / closed a position" alerts.
Sentiment on macro & crypto: whale positioning on Fed and BTC-level markets moves before the retail price does; this is the cheapest way to watch it.
Research: the avgPrice vs curPrice columns give you each whale's entry, so you can measure who's early and who's chasing.

How it's built

Two public endpoints: GET /v1/leaderboard?window=1m&rankType=pnl&limit=25 for the roster and GET /positions?user=<wallet>&limit=100&sortBy=CURRENT per wallet. Pure HTTP, ~25 requests, 10–20 seconds for the whole board. Output per row: rank, wallet, trader name, 30-day PnL and volume, market, side, shares, avg vs current price, current value, cash PnL, % PnL, end date, and a direct market URL. A watchlist mode accepts your own wallet list, and only position rows are charged.

It runs on Apify as Polymarket Top Traders Scraper | Whale Positions & Copy Feed — schedule it, pipe it to Sheets/Slack, or call it from an MCP client. Siblings if you want the full prediction-market stack: Polymarket Kalshi Arbitrage Scanner (same market, two venues, price gap) and Prediction Market Movers (biggest 24h probability swings on both platforms).

If you run it and it saves you a spreadsheet afternoon, a review or bookmark on the Apify page helps more than you'd think.

Not financial advice. Data is a snapshot; whales close positions too.

I scraped all 545 startups for sale on Microns. Sellers ask 4.3x revenue. Buyers pay 3.3x.

Mr Zack — Wed, 02 Sep 2026 19:44:28 +0000

Every micro-acquisition thread ends with the same question: what multiple is fair for a tiny SaaS? People answer from memory. I'd rather answer from the board.

So I pulled every listing on Microns — the marketplace where indie founders sell $1K–$100K micro-startups — as of September 3, 2026. That's 545 listings: 390 still for sale, 155 marked sold. Here's what the numbers say.

1. The ask/clear gap is a full turn of revenue

	Listings with revenue	Median asking price	Median price ÷ ARR
Available (for sale now)	374	$10,750	4.26x
Sold (market comps)	136	$3,000	3.33x

Sellers ask 4.3x annual revenue. What actually clears is 3.3x. If you're buying, the sold column is your anchor, not the listing page. If you're selling, pricing at 5x+ mostly means you'll still be listed in four months — median time on board for available listings is 110 days.

And it's not a few outliers dragging the ask up: 181 of the 390 available listings (46%) are priced above 5x revenue. Only 27 of 136 sold listings (20%) cleared at more than 10x, and those are the tiny-revenue cases where a $3K price on $200 ARR shows up as "15x".

2. Multiples depend on category more than on the startup

Median sold multiple by category (categories with at least 5 sold comps):

Category	Sold comps	Median multiple that cleared
Directory	12	6.75x
Micro-SaaS	36	5.33x
Newsletter	16	4.20x
Web App	20	3.14x
Mobile App	17	2.95x
E-commerce	7	2.08x
YouTube channel	7	1.12x

Two things surprised me. Directories clear at the highest multiple — low maintenance, recurring, SEO-driven cash. And YouTube channels clear at barely 1x revenue: buyers price in the key-person risk. If you own a directory, you're sitting on a more sellable asset than you think.

3. Where the underpriced deals are hiding

Of 390 available listings, 137 are priced at ≤3x revenue and 79 at ≤2x. Thirty listings were added in the last 7 days. The good ones move in days — the median sold listing had a $3,000 price, which is exactly the size an indie buyer can close on a weekend.

The top of my deal score right now (fresh + fairly priced + real revenue + real customers):

Startup	Category	Asking	ARR	Multiple	Days listed
Fashion Online Store	E-commerce	$109,000	$341,000	0.32x	14
AI Image-to-Video Generator	Web App	$30,000	$55,933	0.54x	10
Amazon FBA Decor Brand	E-commerce	$85,000	$103,000	0.83x	28
Relaxation Gummies Store	E-commerce	$36,000	$38,330	0.94x	12
Gamified Fitness / RPG Workout	Micro-SaaS	$19,000	$18,107	1.05x	3

E-commerce dominates the top because revenue there is gross, not net — which is exactly why you need the seller's expenses and businessModel fields next to the multiple before you get excited. The dataset carries both.

How I get this every morning

I didn't do this by hand. It's an Apify Actor I maintain: Microns Startup Listings Scraper. One run = the whole board, HTTP-only (no browser, no login, no proxies), with these fields per listing:

askingPriceUsd, arrUsd, and revenueMultiple (null when ARR is 0 or unpublished — never a fake number)
status = available or sold, so the sold rows double as comps
customers, pricePerCustomer, publishedDate, daysListed, foundedYear
the seller's own businessModel, expenses, growthOpportunity, reasonForSelling, askingPriceReasoning, techStack, competitors
dealScore 0–100: revenue evidence + price fairness vs ~3x + traction + freshness

Every run also writes a SUMMARY record with board totals, available vs sold, median revenue multiple and new-this-week count — so a weekly listingStatus: "sold" run gives you a live micro-startup valuation index that nobody publishes.

The daily deal-alert input I use, on a schedule with a Slack integration:

{ "listingStatus": "available", "minArrUsd": 1, "maxRevenueMultiple": 4, "sortBy": "dealScore" }

Pay-per-result, so a filtered run like that costs cents. It's also callable from AI agents (MCP) — "find me SaaS listings under $20K priced below 3x revenue, added this week" is one tool call.

Caveats, because this is money

Revenue on Microns is self-reported. Multiples are a screening tool, not diligence.
"Sold" means the seller marked it sold; the clearing price is the listed price at that time, which may differ from the final negotiated number.
Sample sizes per category are small (7–36 comps). Treat category medians as direction, not law.
Not financial advice. Verify on the listing page before you message a founder.

If you buy, sell, or benchmark micro-startups and want a field added, open an Issue on the Actor page — the parser is monitored daily.

Finding risk-free arbitrage between Polymarket and Kalshi (and why most arb finders show you garbage)

Mr Zack — Sat, 29 Aug 2026 19:40:21 +0000

Prediction markets exploded this year. The same event — a Fed rate decision, an NFL game, tomorrow's NYC high temperature — often trades on both Polymarket and Kalshi at different prices. Buy YES on one platform and NO on the other for a combined cost under $1.00 and you lock in profit no matter what happens. That's the theory.

The practice: most cross-platform arb tools show you a wall of 90% "edges" that are actually mismatched markets. "Fed rate at 1.75%" paired with "Fed rate above 2.75%". "Bank of England" paired with "Bank of Japan". "Will there be no Gemini release" paired with "When will Gemini release". You waste an evening checking them one by one, find zero real arbs, and never open the tool again.

I built a scanner that treats matching as the hard problem it is. Rules that killed the false positives:

Numeric strikes must agree. If both questions contain non-year numbers and they don't intersect, the pair is dead. 1.75 ≠ 2.75, ever.
Negation must agree. "No X before 2027" never pairs with "X before 2027".
Directions must not conflict. "Above" never pairs with "below"; "above" against no direction at all gets penalized — different payoff shapes.
Dates must be close. End dates more than 3 days apart = different markets, even with identical wording.
Edges above 15% are flagged suspicious, not celebrated. A real cross-platform gap is 0.3–6%. If a tool shows you 90%, it matched the wrong market.
Kalshi's 7% fee is subtracted before anything is called an arb. A 1.5% gross gap that dies after fees is not an opportunity.

On a full scan this morning — ~2,000 high-volume Polymarket binaries against ~60,000 open Kalshi markets — it matched 345 equivalent pairs and 25 of them were genuine net-positive arbs (0.3% to 6% after fees): Trump–Kim meeting, measles case counts, a couple of 2028 nominee long shots.

Both APIs are public and unauthenticated (Polymarket's Gamma API, Kalshi's trade API v2), so the whole thing is plain HTTP — no proxies, no keys, no headless browser. The matcher is ~200 lines of deterministic token/entity logic: alias table (BTC→bitcoin, Fed→federal-reserve), day-of-month detection so "Dec 31" doesn't become a strike price, inverted-index blocking so 2k × 60k comparisons stay under 200ms.

I packaged it as a pay-per-event Apify actor: Polymarket Kalshi Arbitrage Scanner. Run it on a 15–60 min schedule with minNetEdgePct: 0 and you only pay for rows that are actually actionable. If you trade weather markets specifically, the Kalshi Weather Markets Scraper is the companion piece.

Not financial advice — arbs decay in minutes, liquidity at the quoted ask matters, and you should always verify on-platform before putting money down. But if you're going to hunt cross-platform edges, at least hunt real ones.

Stop Opening Two Ad Libraries Every Morning — One Feed for Google + LinkedIn Ads

Mr Zack — Fri, 28 Aug 2026 19:09:17 +0000

If you do competitive ad research, your morning probably looks like this: open the Google Ads Transparency Center, search the brand, screenshot a few creatives... then open the LinkedIn Ad Library, search the same brand again, and try to line the two up in a spreadsheet.

Two tabs. Two search UIs. Two export formats (actually zero export formats — neither site has one).

I built an Apify actor that collapses this into a single normalized feed: Brand Ads Spy — Google + LinkedIn Ads in One Feed.

What it does

Give it a list of brand names or domains. It pulls, for each brand:

Google Ads Transparency Center — every active creative (text, image, video), regions, first/last shown dates
LinkedIn Ad Library — every ad, advertiser, format, paying entity, EU run dates

...and returns them in one dataset with a shared schema:

Field	Meaning
`network`	`google` or `linkedin`
`adId`	stable ID on that network
`advertiser`	advertiser / page name
`format`	text / image / video
`adText`	creative text where available
`firstShownAt` / `lastShownAt`	date range the ad ran
`isNew`	first time this actor has seen this ad
`mediaUrls`	creative assets
`libraryUrl`	deep link back to the source library
`payer`	who paid (LinkedIn EU transparency data)

No login, no proxies, no browser rendering — both legs are plain HTTP, so runs finish in seconds and cost stays at $1.20 per 1,000 ad results.

Monitor mode: only pay for what's new

Set onlyNew: true and the actor remembers every ad ID it has seen (across both networks). The next run only emits — and only charges for — ads that appeared since last time. That turns it from a scraper into a change monitor: "tell me when my competitor launches a new campaign, on either network."

How to schedule it (the whole point)

Ad intelligence is only useful if it's fresh. On Apify:

Open the actor page → Try for free
Set your brands list and onlyNew: true
Save the task → Schedules → e.g. 0 7 * * * (every morning, 7 AM)
Add an integration (Slack, email, webhook) so new ads land where you work

Every morning you get a diff of your competitors' ad activity across Google and LinkedIn — without opening either library.

Why cross-network matters

B2B brands stage campaigns differently per channel: LinkedIn gets the expensive lead-gen creative first, Google gets the retargeting variants a week later (or the reverse). Seeing one network gives you half the story; the interesting signal is in the gap between them — a brand live on LinkedIn but dark on Google is usually mid-launch.

If you only need the Google side, the standalone Google Ads Transparency Scraper is $0.64/1k.

Questions or feature requests — comments are open, and reviews on the actor page genuinely help a small builder. 🙏

Your browser extensions can read every site you visit. Auditing 200 of them takes one scrape

Mr Zack — Thu, 27 Aug 2026 19:10:47 +0000

A Chrome extension with <all_urls> host access can read your banking session, your email, your internal admin panels — every page you open. Most orgs have no idea which of the extensions their people installed request that level of access. The Chrome Web Store won't tell you in bulk: permission info lives inside each extension's manifest, one listing at a time.

I kept seeing the same manual workflow: a security reviewer opens 40 extension pages, clicks through to the details, squints at the permission list, pastes findings into a sheet. Next quarter, repeat, because versions and permissions changed.

That's a scraping problem, so I built Chrome Web Store Intelligence & Permission-Risk Scraper — it turns any list of extensions, search queries, or whole categories into structured rows with a documented 0–100 permission-risk score. $2.40 per 1,000 extensions, HTTP-only, no login, no API key.

What you get per extension

One row per extension with the fields a review actually needs:

Field	Example
`name` / `extensionId`	`uBlock Origin` / `cjpalhdl…`
`rating` / `ratingCount` / `userCount`	`4.7` / `35450` / `11000000`
`version` / `lastUpdatedDays` / `isAbandoned`	`1.74.0` / `0.3` / `false`
`apiPermissions`	`["scripting","tabs","cookies"]`
`hostPermissions`	`["https:///"]`
`permissionRiskScore`	`86`
`riskLevel`	`critical`
`riskFlags`	`["broad_host_access","reads_cookies"]`

The risk model is transparent: broad host access (<all_urls>, *://*/*), debugger, nativeMessaging, proxy, management, cookies, webRequest, history and friends each carry documented weights. Every score comes with human-readable flags so you can see why something is critical, not just that it is. It handles both Manifest V2 and V3, and flags extensions abandoned for over a year — the quiet way risky code stays installed forever.

Three input modes

{
  "searchQueries": ["password manager"],
  "categories": ["extensions/productivity/tools"],
  "maxExtensions": 200,
  "minUsers": 10000,
  "onlyRiskLevels": ["high", "critical"]
}

Paste explicit extension URLs/IDs, run search queries, or enumerate whole categories — mixed in one run. Filters (minUsers, minRating, onlyRiskLevels, requireBroadHostAccess) run before charging: filtered-out extensions are free. The example above returns exactly the shortlist a security reviewer wants — popular extensions with dangerous permission sets.

It's not only for security teams. Extension developers use the same rows to track competitor ratings, user growth and update cadence; acquirers screen for abandoned extensions with big install bases.

Put it on a schedule

The data rots fast — versions ship weekly, permissions change silently on update, new extensions appear daily. The useful setup is not one run, it's a standing audit:

Run once with your allowlist (or a category) as input, sanity-check the output.
On the actor page: ⋯ menu → Schedule Actor, cron 0 7 * * 1 (weekly Monday morning fits most review cadences).
Add a Google Sheets or Slack integration on Run succeeded, filtered to riskLevel in high/critical.

From then on, a permission escalation in an extension your org uses shows up in Slack Monday morning instead of in an incident report.

MCP / AI-agent angle

The actor is exposed via Apify's MCP server, so an AI agent can call it as a tool: "audit these 30 extensions and summarize which ones can read cookies on all sites" becomes one tool call returning structured JSON the agent can reason over. Agent-driven security reviews are exactly the kind of repetitive, structured task this was built for.

I build pay-per-event scrapers for boards people refresh manually — the full portfolio is here. If you try the extension scraper and something's missing, open an issue on the actor; field requests routinely ship within days.

Clippers refresh three reward boards every morning. Here's the data stack that does it for them

Mr Zack — Tue, 18 Aug 2026 19:12:50 +0000

"Clipping" is the job where you cut short-form videos for a brand and get paid per 1,000 views. It went from niche to industry fast: Whop's Content Rewards board alone currently lists 501 active campaigns with $2.64M in total budgets — $1.46M of it still unclaimed (live numbers, scraped today).

The problem: the money is spread across multiple boards that don't talk to each other, and every one of them moves daily. MrBeast ran a campaign on Vyro that burned through its budget in days. Whop campaigns routinely fill up overnight. If you clip for a living, your morning routine is opening three tabs and eyeballing what changed.

That's a data problem, not a hustle problem. So I built a scraper for each board. All three are HTTP-only, no login, and return normalized JSON you can pipe anywhere — Sheets, a Discord bot, your own dashboard.

The stack

1. Whop Content Rewards — the big board

Whop Content Rewards Scraper pulls every campaign from contentrewards.com in one run: reward per 1,000 views, total budget, budget spent/left, progress %, platforms, category, verification status.

Today's board: 501 active campaigns, reward rates from under $0.10 to four figures per 1k views, and $1.46M in budgets not yet paid out. Sorting by budgetLeftUsd instead of scrolling the default order is the entire edge.

2. Vyro — small board, big spikes

Vyro Clipping Campaigns Scraper covers vyro.com — the marketplace MrBeast uses. The board is tiny (right now: literally one live campaign, a $250,000 MrBeast drop), but that's exactly why it needs a monitor, not a browser tab: when something lands here, it burns fast. MrBeast's previous campaign spent $20K in under 8 days.

The scraper computes remainingViews, budgetSpentPct, isFreshWithin24h, and an opportunityScore, and takes a freshWithinHours input — so a scheduled run only alerts you when something new shows up.

3. ClipAffiliates — the only board that shows your competition

ClipAffiliates Clipping Campaigns Scraper covers clipaffiliates.com (4 campaigns today, CPM $0.75–$2.00). Its unique field: active_affiliates_count — how many clippers are already working each campaign. No other clipping board publishes this.

From that, the scraper derives remainingUsdPerAffiliate (budget left ÷ people competing for it) and a lowCompetition sort. A $500 pool with 85 affiliates on it is a worse bet than a $100 pool with 23. Now that's a number, not a vibe.

Why scheduled runs are the whole point

None of this data is worth much as a one-off export. It's worth a lot as a diff. The pattern for all three actors:

Open the actor page → Schedules tab → create a schedule (e.g. every 6 hours, ~$0.01–0.05/run at these board sizes).
Point the integration at Google Sheets, or use a webhook to push new rows to Discord/Slack.
Filter on the freshness fields (isFreshWithin24h, fundedAt, end_date) so you only see what changed.

Clippers who do this see new campaigns hours before the people refreshing tabs — on boards where budgets are first-come-first-served, that's the difference between claiming a fresh $250k pool and reading about it.

Honest limitations

These scrape public board data only — no login, no private campaign details, no bypassing anything.
Boards change their markup; the actors retry defensively and I fix breakage fast (the Whop one has run >800 times at >99% success).
Vyro's board being 1 campaign today isn't a bug — it's a small marketplace. That's why it's priced per result: an empty-board check costs you nearly nothing.

If you clip — or you're building tooling for people who do — the three actors are Whop CR, Vyro, and ClipAffiliates. Feedback and field requests welcome — reviews on the Apify listings genuinely help an indie dev.

Immunefi lists $150M+ in bug bounties. The board doesn't tell you which ones are worth your weekend

Mr Zack — Wed, 12 Aug 2026 00:37:46 +0000

Immunefi's board lists ~190 bug bounty programs and ~60 audit competitions, with top bounties up to $15,000,000 (LayerZero). If you hunt Web3 bugs, you've scrolled it. And you've probably noticed the sort order: by vault TVL. That's a fine number for Immunefi to showcase — it's just not your number.

Your number is: how much friction stands between me and getting paid?

Because the board hides the expensive part in each program's fine print:

KYC required? Excludes anonymous researchers entirely. On today's data: 132 of 248 programs require it, 116 don't.
Pay-to-submit fee? Some programs charge USDC just to file a report. 30 programs do; most researchers find out at submit time.
Proof of concept: "not required" vs "required" vs "runnable" is the difference between an evening and a week.
Invite-only? You can't even join.

Comparing that across 248 programs means opening 248 pages. So I scraped it — the data is all public, HTTP-only, no login.

One row per program

Immunefi Bug Bounty & Audit Competition Scraper pulls both boards in ~5 seconds and computes two scores per program:

frictionScore (0–100, lower = easier to get paid): KYC 35%, pay-to-submit fee 25%, PoC requirement 25%, invite-only 15%. Normalized over what the program actually publishes — unknown fields don't fake a score.

opportunityScore (0–100, "worth my weekend?"): bounty size 45% (log-scaled — bounties span four orders of magnitude), low friction 25%, program upkeep 15% (freshly updated = actually maintained), payout assurance 15% (funded vault + Safe Harbor + Immunefi Standard).

{
  "project": "Sky",
  "board": "bug-bounty",
  "maxBountyUsd": 10000000,
  "kycRequired": false,
  "payToSubmit": false,
  "proofOfConceptType": "required",
  "inviteOnly": false,
  "frictionScore": 15,
  "daysSinceUpdate": 21.1,
  "opportunityScore": 88.8
}

A $10M max bounty with no KYC and no submit fee is a very different object from a $10M bounty behind KYC + $500 USDC + runnable PoC. The default board renders them identically.

Three queries the board can't answer

"Anonymous-friendly, big money": { "kycRequired": false, "minMaxBountyUsd": 1000000, "sortBy": "opportunity" } — today that's a shortlist of 16 programs, Sky's $10M at the top.

"Live audit competitions with a deadline": competitions carry rewardsPoolUsd, endDate and daysUntilEnd — deadline-driven work with a fixed pool, deduplicated against the bounty board.

"Recently maintained only": daysSinceUpdate filters out programs nobody has touched in a year. A stale program page is a weak signal the triage queue is stale too.

Schedule it

The board changes daily (Immunefi updates program metrics every day, and competitions open/close on deadlines). One scheduled run per morning:

Actor page → ⋯ → Schedule, cron 0 7 * * *
Input: { "sortBy": "opportunity", "excludeInviteOnly": true }
Full run over 248 programs costs about $0.30 (pay-per-event, from $1.20/1k results).

The Actor ships a typed output schema and works over MCP, so an AI agent can call it as a tool — "find me no-KYC bounties over $1M updated this month" becomes a filter, not a scraping project.

Fair-use note

Everything scraped is on Immunefi's public pages — no login, no private program data, no vulnerability reports, and the Actor doesn't help you bypass anything (the friction fields tell you the rules; they don't break them). Rate is one HTTP request per board per run.

Try it: https://apify.com/tactful_anvil/immunefi-bug-bounty-audit-competition-scraper

Found a program with wrong data, or want another field (languages, ecosystems and vault balances are already in there)? Issues tab on the Actor page — parser bugs get fixed.

Most "big budget" clipping campaigns never pay. Here's how to spot them from one scrape

Mr Zack — Wed, 12 Aug 2026 00:17:25 +0000

If you clip short-form video for money, you know Whop Content Rewards: hundreds of live campaigns paying $0.15–$20 per 1,000 views. The discover page lets you sort by budget. That sort is quietly costing you nights of work.

Here's the number that changed how I pick campaigns: on the live board right now, 21% of active campaigns have never paid out a single cent. Big banner budget, $0 actually spent. A "$30,000 budget" campaign that has paid nobody in three weeks is not a $30,000 opportunity — it's a landing page.

The problem: the board doesn't show you payout speed. You can see budget and budget left, but not how fast the money is actually moving — and that's the only number that separates a campaign that pays from a campaign that poses.

The trick: the page already contains everything you need

Every campaign card on Whop publishes three things: when it was funded, how much has been spent, and how many creators joined. From one snapshot — no monitoring, no state between runs — you can derive:

dailyBurnUsd        = budgetSpent / daysSinceFunded     → is money moving?
estimatedDaysLeft   = budgetLeft / dailyBurnUsd         → will it still be there?
payoutPerCreatorUsd = budgetSpent / creators            → what did the average clipper earn?
budgetPace          = "draining" | "healthy" | "slow" | "stalled"

That last field is the shortcut. On today's board of 456 campaigns:

pace	meaning	what to do
`draining`	<3 days of budget left	skip — gone before your clip gains traction
`healthy`	3–60 days	this is where you clip
`slow`	60–180 days	fine, but budget may outlive the campaign
`stalled`	>180 days at current burn	the "big budget" mirage — money posted, almost nobody paid
`null`	zero paid out so far	unproven; could be brand new, could be dead

Real example from today: two campaigns, both showing ~$30K budget. One burns $255/day and has paid the average creator $75. The other burns $19/day — at that rate its budget lasts four years, which is a polite way of saying nobody is getting paid. On the default board they look identical.

I packaged this as an Apify Actor

Whop Content Rewards Scraper pulls the full board (~456 campaigns) in about 5 seconds, HTTP-only, and computes all of the above per row, plus an opportunityScore that ranks by reward rate (35%), budget headroom (25%), competition (25%) and payout velocity (15%).

One honesty note, because it's the part I got wrong first: an early version of the score treated empty campaigns as "low competition" and ranked them near the top. That's backwards — a campaign nobody has joined and that has never paid is not uncontested, it's untested, and the data can't tell those apart. The current version gives no free marks for emptiness: unproven campaigns still rank, they just can't outrank a campaign that demonstrably pays. The scoring weights are documented in the README so you can argue with them.

{
  "title": "WINNA",
  "rewardPerThousandViews": 5,
  "budgetLeftUsd": 11659.17,
  "dailyBurnUsd": 272.67,
  "estimatedDaysLeft": 42.8,
  "budgetPace": "healthy",
  "payoutPerCreatorUsd": 75.25,
  "creators": 164,
  "opportunityScore": 71.1
}

The daily recipe

The actual decision — "where do I clip tonight?" — as one scheduled run:

Input: { "sortBy": "opportunity", "minEstimatedDaysLeft": 3, "minPayoutPerCreatorUsd": 5 }
Schedule it daily in Apify Console (Actor → ⋯ → Schedule; cron 0 7 * * *).
Read the top 10 rows with your coffee. Campaigns that pay real money to real creators, ranked.

A full-board run costs well under a dollar (pay-per-event, from $1.50/1k results). Once a day is plenty — the board moves daily, not by the second.

For AI agents

The Actor ships a typed output schema and works over MCP, so an agent can answer "which clipping campaigns are actually paying right now?" by calling it as a tool and filtering budgetPace == "healthy" — no scraping code inside your agent.

Try it: https://apify.com/tactful_anvil/whop-content-rewards-scraper

I clip too. This exists because I got tired of finding out a "$30K budget" was a mirage after posting to it. Bug reports and field requests: Issues tab on the Actor page.