Immunefi's board lists ~190 bug bounty programs and ~60 audit competitions, with top bounties up to $15,000,000 (LayerZero). If you hunt Web3 bugs, you've scrolled it. And you've probably noticed the sort order: by vault TVL. That's a fine number for Immunefi to showcase — it's just not your number.
Your number is: how much friction stands between me and getting paid?
Because the board hides the expensive part in each program's fine print:
- KYC required? Excludes anonymous researchers entirely. On today's data: 132 of 248 programs require it, 116 don't.
- Pay-to-submit fee? Some programs charge USDC just to file a report. 30 programs do; most researchers find out at submit time.
- Proof of concept: "not required" vs "required" vs "runnable" is the difference between an evening and a week.
- Invite-only? You can't even join.
Comparing that across 248 programs means opening 248 pages. So I scraped it — the data is all public, HTTP-only, no login.
One row per program
Immunefi Bug Bounty & Audit Competition Scraper pulls both boards in ~5 seconds and computes two scores per program:
frictionScore (0–100, lower = easier to get paid): KYC 35%, pay-to-submit fee 25%, PoC requirement 25%, invite-only 15%. Normalized over what the program actually publishes — unknown fields don't fake a score.
opportunityScore (0–100, "worth my weekend?"): bounty size 45% (log-scaled — bounties span four orders of magnitude), low friction 25%, program upkeep 15% (freshly updated = actually maintained), payout assurance 15% (funded vault + Safe Harbor + Immunefi Standard).
{
"project": "Sky",
"board": "bug-bounty",
"maxBountyUsd": 10000000,
"kycRequired": false,
"payToSubmit": false,
"proofOfConceptType": "required",
"inviteOnly": false,
"frictionScore": 15,
"daysSinceUpdate": 21.1,
"opportunityScore": 88.8
}
A $10M max bounty with no KYC and no submit fee is a very different object from a $10M bounty behind KYC + $500 USDC + runnable PoC. The default board renders them identically.
Three queries the board can't answer
"Anonymous-friendly, big money": { "kycRequired": false, "minMaxBountyUsd": 1000000, "sortBy": "opportunity" } — today that's a shortlist of 16 programs, Sky's $10M at the top.
"Live audit competitions with a deadline": competitions carry rewardsPoolUsd, endDate and daysUntilEnd — deadline-driven work with a fixed pool, deduplicated against the bounty board.
"Recently maintained only": daysSinceUpdate filters out programs nobody has touched in a year. A stale program page is a weak signal the triage queue is stale too.
Schedule it
The board changes daily (Immunefi updates program metrics every day, and competitions open/close on deadlines). One scheduled run per morning:
- Actor page → ⋯ → Schedule, cron
0 7 * * * - Input:
{ "sortBy": "opportunity", "excludeInviteOnly": true } - Full run over 248 programs costs about $0.30 (pay-per-event, from $1.20/1k results).
The Actor ships a typed output schema and works over MCP, so an AI agent can call it as a tool — "find me no-KYC bounties over $1M updated this month" becomes a filter, not a scraping project.
Fair-use note
Everything scraped is on Immunefi's public pages — no login, no private program data, no vulnerability reports, and the Actor doesn't help you bypass anything (the friction fields tell you the rules; they don't break them). Rate is one HTTP request per board per run.
Try it: https://apify.com/tactful_anvil/immunefi-bug-bounty-audit-competition-scraper
Found a program with wrong data, or want another field (languages, ecosystems and vault balances are already in there)? Issues tab on the Actor page — parser bugs get fixed.
Top comments (0)