Autonomous Fresh Bug Bounty & VDP Discovery Radar
Discovers newly launched, self-hosted, and unlisted bug bounty programs in the background without needing to visit websites.
Left (v1.2 Showcase): In-app auto-update notifications, Active Tab Target Sniffer (detects current browsing targets), ⭐ Bookmarks, 📝 Private Recon Notes, and multi-tool exports.
Right: Cyberpunk Bento Grid with 5 reactive metric cards (13,757+ Programs, 39,642+ Targets, 852+ Fresh, 1,586+ Self-Hosted, 224+ Private), global regional radar, and 1-click scope copy.
Traditional browser extensions require you to manually browse to target websites before they detect anything. BountyRadar inverts this model:
- Autonomous Feed Ingestion: In the background, BountyRadar pulls from live global trackers: Disclose.io (diodb), HackerOne, Bugcrowd, ProjectDiscovery, Intigriti, YesWeHack, plus 3,500+ in-scope Wildcards and 36,000+ Target Domains.
- Massive Index of 12,500+ Organizations & 30,000+ Targets: Dynamically aggregates over 12,500+ verified bug bounty & VDP organizations and 30,000+ in-scope target domains across 20+ countries and sovereign extensions.
- 🎯 Dedicated Wildcard Scope Radar: Filter directly by wildcard targets (
*.example.com) across 1,800+ programs for deep subdomain takeover & enumeration workflows. - 🌍 Global Country & TLD Regional Radar: Automatically detects and tags programs by national domain extensions and sovereign regions (
🏛️ .gov,🇩🇪 .de,🇬🇧 .uk,🇳🇱 .nl,🇨🇭 .ch,🇮🇳 .in,🇦🇺 .au,🇨🇦 .ca,🇫🇷 .fr,🇪🇺 .eu,🎓 .edu,🇧🇷 .br,🌐 US/Global). - Zero-Click Auto-Sync: Automatically checks and syncs live feeds on browser startup and popup launch—no manual buttons required.
- Diff & Fresh Discovery Engine: Tracks newly added programs and flags them with
🔥 NEW. - 1-Click Scope Copy: Copy all in-scope domains formatted line-by-line, ready to pipe into
subfinder,httpx, ornuclei.
BountyRadar works identically on Windows, Linux, and macOS across any Chromium or Firefox-based browser.
git clone https://github.com/tejassroot/BountyRadar.git- Click the green Code button at the top of this repository.
- Click Download ZIP.
- Extract the downloaded
BountyRadar-main.zipfolder on your computer.
Recommended: Stays permanently installed across all browser sessions.
- Open your browser and navigate to the extensions page:
- Chrome:
chrome://extensions - Brave:
brave://extensions - Edge:
edge://extensions
- Chrome:
- Toggle on Developer mode (switch in the top-right corner).
- Click the "Load unpacked" button in the top-left corner.
- Select the extracted
BountyRadarfolder (containingmanifest.json). - Done! Click the puzzle icon (🧩) on your browser toolbar and pin BountyRadar.
- Open Firefox and type in the address bar:
about:debugging#/runtime/this-firefox - Click "Load Temporary Add-on…".
- Open the
BountyRadarfolder and select themanifest.jsonfile. - Pin the icon to your toolbar from the Extensions (🧩) menu.
Or run from terminal with live reload:
# Linux / macOS
cd BountyRadar && npx web-ext run
# Windows (PowerShell / Command Prompt)
cd BountyRadar; npx web-ext run| Feature | Description |
|---|---|
| 📜 RFC 9116 security.txt Sniffer | Passively detects hidden & unlisted VDPs on any domain you browse (/.well-known/security.txt) with PGP keys, direct contacts, and 1-click bookmarks. |
| 🚀 In-App Auto-Updates | Checks GitHub releases in the background and alerts researchers with 1-click update downloads. |
| Instant push webhook alerts to your Telegram bot or email digest when fresh bug bounty programs drop. | |
| 🎯 Active Tab Target Sniffer | Instantly highlights when you browse an in-scope website (💰 $15,000 / 🎯 In-Scope / 📜 VDP). |
| 🧰 Multi-Tool Exporter | 1-Click exports for Nuclei (targets.txt), Burp Suite Scope (burp_scope.json), and Subfinder. |
| ⭐ Bookmarks & 📝 Notes | Star favorite programs and write private confidential recon notes directly onto target cards. |
| ⚡ Zero-Click Sync | Automatically pulls fresh data on startup; no manual sync clicking needed. |
| 🎯 Wildcard Radar | Isolate 1,800+ wildcard domain programs (*.example.com) for massive subdomain expansion. |
| 🌍 Country & TLD Radar | Filter across 20+ national and sovereign domains (.gov, .de, .uk, .nl, .in, .ch, .au, .ca, .fr, etc.). |
| ♾️ Unlimited Live Ingestion | Ingests 13,750+ programs and 39,600+ targets dynamically with cache-busting live diffs. |
| 📊 5-Card Bento Grid | Real-time counts for Programs, 🎯 Targets, 🔥 Fresh, 🌐 Self-Hosted, and 🔒 Private. |
| 📋 1-Click Scope Copy | Click "Copy Scope" on any program to copy all target domains formatted for recon CLI tools. |
| 🏷️ Asset Category Chips | Filter across Web, API, Mobile, Cloud, Crypto, Hardware/IoT, and security.txt. |
| 🔍 Smart Search & Hotkey | Press / to focus search across 30,000+ target domains, companies, countries, and platforms. |
BountyRadar autonomously monitors global trackers in the background. When fresh bug bounty programs, unlisted self-hosted VDPs, or escalated scopes are detected, it immediately pushes structured alerts straight to your phone or desktop.
🚨 BountyRadar Discovery Alert
Found 3 newly discovered bug bounty programs!
1. Acme Cloud Security
• Type: 💰 Bounty | 🏢 HackerOne
• Policy: https://hackerone.com/acme
• In-Scope: *.acmecloud.com, api.acme.io
2. Fintech Secure Ltd
• Type: 🎯 VDP | 🌐 Self-Hosted
• Policy: https://fintech.de/.well-known/security.txt
• In-Scope: *.fintech.de, auth.fintech.de
- Create Bot: Message @BotFather on Telegram and send
/newbot. Follow prompts and copy the HTTP API Token. - Activate: Open your new bot's link (e.g.,
t.me/your_bounty_bot) and press Start (or send/start). - Get Chat ID: Message @userinfobot on Telegram to get your numeric user
Id. - Configure: Open BountyRadar, click the ⚙️ (Settings) icon in the header, toggle Telegram Push Alerts, paste your token and Chat ID, and click "Ping Telegram Test".
- Create a free account at resend.com (includes 3,000 free emails/month) and generate an API key.
- Open BountyRadar Settings (⚙️), toggle Email Digest Alerts, enter your Resend API Key and Destination Email, then click "Send Test Email".
BountyRadar/
├── manifest.json # Manifest V3 cross-browser configuration
├── background.js # Background service worker & auto-sync alarms
├── feeds.js # Multi-source parser (Disclose.io, H1, Bugcrowd, etc.)
├── popup.html # Cyber-obsidian bento grid dashboard
├── popup.css # Glassmorphic responsive dark stylesheet
├── popup.js # Reactive state, token search & clipboard integration
├── icons/ # Extension brand assets (16px, 48px, 128px)
├── assets/images/ # Interface preview screenshots and hero banner
└── dist/ # Packaged production zip release
Contributions, feedback, and feed additions are welcome! Open an issue or pull request.
Licensed under the MIT License.