DEV Community: Mr Zack

Immunefi lists $150M+ in bug bounties. The board doesn't tell you which ones are worth your weekend

Mr Zack — Wed, 12 Aug 2026 00:37:46 +0000

Immunefi's board lists ~190 bug bounty programs and ~60 audit competitions, with top bounties up to $15,000,000 (LayerZero). If you hunt Web3 bugs, you've scrolled it. And you've probably noticed the sort order: by vault TVL. That's a fine number for Immunefi to showcase — it's just not your number.

Your number is: how much friction stands between me and getting paid?

Because the board hides the expensive part in each program's fine print:

KYC required? Excludes anonymous researchers entirely. On today's data: 132 of 248 programs require it, 116 don't.
Pay-to-submit fee? Some programs charge USDC just to file a report. 30 programs do; most researchers find out at submit time.
Proof of concept: "not required" vs "required" vs "runnable" is the difference between an evening and a week.
Invite-only? You can't even join.

Comparing that across 248 programs means opening 248 pages. So I scraped it — the data is all public, HTTP-only, no login.

One row per program

Immunefi Bug Bounty & Audit Competition Scraper pulls both boards in ~5 seconds and computes two scores per program:

frictionScore (0–100, lower = easier to get paid): KYC 35%, pay-to-submit fee 25%, PoC requirement 25%, invite-only 15%. Normalized over what the program actually publishes — unknown fields don't fake a score.

opportunityScore (0–100, "worth my weekend?"): bounty size 45% (log-scaled — bounties span four orders of magnitude), low friction 25%, program upkeep 15% (freshly updated = actually maintained), payout assurance 15% (funded vault + Safe Harbor + Immunefi Standard).

{
  "project": "Sky",
  "board": "bug-bounty",
  "maxBountyUsd": 10000000,
  "kycRequired": false,
  "payToSubmit": false,
  "proofOfConceptType": "required",
  "inviteOnly": false,
  "frictionScore": 15,
  "daysSinceUpdate": 21.1,
  "opportunityScore": 88.8
}

A $10M max bounty with no KYC and no submit fee is a very different object from a $10M bounty behind KYC + $500 USDC + runnable PoC. The default board renders them identically.

Three queries the board can't answer

"Anonymous-friendly, big money": { "kycRequired": false, "minMaxBountyUsd": 1000000, "sortBy": "opportunity" } — today that's a shortlist of 16 programs, Sky's $10M at the top.

"Live audit competitions with a deadline": competitions carry rewardsPoolUsd, endDate and daysUntilEnd — deadline-driven work with a fixed pool, deduplicated against the bounty board.

"Recently maintained only": daysSinceUpdate filters out programs nobody has touched in a year. A stale program page is a weak signal the triage queue is stale too.

Schedule it

The board changes daily (Immunefi updates program metrics every day, and competitions open/close on deadlines). One scheduled run per morning:

Actor page → ⋯ → Schedule, cron 0 7 * * *
Input: { "sortBy": "opportunity", "excludeInviteOnly": true }
Full run over 248 programs costs about $0.30 (pay-per-event, from $1.20/1k results).

The Actor ships a typed output schema and works over MCP, so an AI agent can call it as a tool — "find me no-KYC bounties over $1M updated this month" becomes a filter, not a scraping project.

Fair-use note

Everything scraped is on Immunefi's public pages — no login, no private program data, no vulnerability reports, and the Actor doesn't help you bypass anything (the friction fields tell you the rules; they don't break them). Rate is one HTTP request per board per run.

Try it: https://apify.com/tactful_anvil/immunefi-bug-bounty-audit-competition-scraper

Found a program with wrong data, or want another field (languages, ecosystems and vault balances are already in there)? Issues tab on the Actor page — parser bugs get fixed.

Most "big budget" clipping campaigns never pay. Here's how to spot them from one scrape

Mr Zack — Wed, 12 Aug 2026 00:17:25 +0000

If you clip short-form video for money, you know Whop Content Rewards: hundreds of live campaigns paying $0.15–$20 per 1,000 views. The discover page lets you sort by budget. That sort is quietly costing you nights of work.

Here's the number that changed how I pick campaigns: on the live board right now, 21% of active campaigns have never paid out a single cent. Big banner budget, $0 actually spent. A "$30,000 budget" campaign that has paid nobody in three weeks is not a $30,000 opportunity — it's a landing page.

The problem: the board doesn't show you payout speed. You can see budget and budget left, but not how fast the money is actually moving — and that's the only number that separates a campaign that pays from a campaign that poses.

The trick: the page already contains everything you need

Every campaign card on Whop publishes three things: when it was funded, how much has been spent, and how many creators joined. From one snapshot — no monitoring, no state between runs — you can derive:

dailyBurnUsd        = budgetSpent / daysSinceFunded     → is money moving?
estimatedDaysLeft   = budgetLeft / dailyBurnUsd         → will it still be there?
payoutPerCreatorUsd = budgetSpent / creators            → what did the average clipper earn?
budgetPace          = "draining" | "healthy" | "slow" | "stalled"

That last field is the shortcut. On today's board of 456 campaigns:

pace	meaning	what to do
`draining`	<3 days of budget left	skip — gone before your clip gains traction
`healthy`	3–60 days	this is where you clip
`slow`	60–180 days	fine, but budget may outlive the campaign
`stalled`	>180 days at current burn	the "big budget" mirage — money posted, almost nobody paid
`null`	zero paid out so far	unproven; could be brand new, could be dead

Real example from today: two campaigns, both showing ~$30K budget. One burns $255/day and has paid the average creator $75. The other burns $19/day — at that rate its budget lasts four years, which is a polite way of saying nobody is getting paid. On the default board they look identical.

I packaged this as an Apify Actor

Whop Content Rewards Scraper pulls the full board (~456 campaigns) in about 5 seconds, HTTP-only, and computes all of the above per row, plus an opportunityScore that ranks by reward rate (35%), budget headroom (25%), competition (25%) and payout velocity (15%).

One honesty note, because it's the part I got wrong first: an early version of the score treated empty campaigns as "low competition" and ranked them near the top. That's backwards — a campaign nobody has joined and that has never paid is not uncontested, it's untested, and the data can't tell those apart. The current version gives no free marks for emptiness: unproven campaigns still rank, they just can't outrank a campaign that demonstrably pays. The scoring weights are documented in the README so you can argue with them.

{
  "title": "WINNA",
  "rewardPerThousandViews": 5,
  "budgetLeftUsd": 11659.17,
  "dailyBurnUsd": 272.67,
  "estimatedDaysLeft": 42.8,
  "budgetPace": "healthy",
  "payoutPerCreatorUsd": 75.25,
  "creators": 164,
  "opportunityScore": 71.1
}

The daily recipe

The actual decision — "where do I clip tonight?" — as one scheduled run:

Input: { "sortBy": "opportunity", "minEstimatedDaysLeft": 3, "minPayoutPerCreatorUsd": 5 }
Schedule it daily in Apify Console (Actor → ⋯ → Schedule; cron 0 7 * * *).
Read the top 10 rows with your coffee. Campaigns that pay real money to real creators, ranked.

A full-board run costs well under a dollar (pay-per-event, from $1.50/1k results). Once a day is plenty — the board moves daily, not by the second.

For AI agents

The Actor ships a typed output schema and works over MCP, so an agent can answer "which clipping campaigns are actually paying right now?" by calling it as a tool and filtering budgetPace == "healthy" — no scraping code inside your agent.

Try it: https://apify.com/tactful_anvil/whop-content-rewards-scraper

I clip too. This exists because I got tired of finding out a "$30K budget" was a mirage after posting to it. Bug reports and field requests: Issues tab on the Actor page.