Top 22 Python bug-bounty Projects

bug-bounty

• Add a project

1. dirsearch

   1 12 14,462 8.9 Python

   Web path scanner

   

2. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. claude-bug-bounty

   2 1 3,861 8.8 Python

   AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.

   

   Project mention: Show HN: Pentesting Tool Using Claude | news.ycombinator.com | 2026-03-26

4. clairvoyance

   3 2 1,488 4.6 Python

   Obtain GraphQL API schema even if the introspection is disabled

   

5. diodb

   4 10 1,072 5.2 Python

   Open-source vulnerability disclosure and bug bounty program database

   

6. resolvers

   5 0 1,021 9.5 Python

   The most exhaustive list of reliable DNS resolvers. (by trickest)

   

7. pentest-ai

   6 1 266 - Python

   Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

   

   Project mention: Show HN: Ptai – an MCP that chains low-sev findings into RCE | news.ycombinator.com | 2026-05-19

8. webdork

   7 1 155 4.6 Python

   A Python tool to automate some dorking stuff to find information disclosures.

   

9. ParaForge

   8 3 142 2.7 Python

   A BurpSuite extension to create a custom word-list of endpoint and parameters for enumeration and fuzzing

   

10. Layla

    9 1 75 0.0 Python

    [EN] BETA: Layla - recon tool for bug bounty

    

11. Beginner-Bug-Bounty-Automation

    10 2 61 3.4 Python

    Many script that can be modified according to your needs for Information Gathering and Asset discovery in Bug Bounty Hunting (Pull requests are welcome!)

    

12. Claude-BugHunter

    11 1 28 - Python

    A Claude Code skill bundle for bug hunting and external red-team work - 51 skills, 15 slash commands, 574+ disclosed-report patterns curated across 24 vulnerability classes, plus enterprise identity + infrastructure attack matrices.

    

    Project mention: Show HN: Claude Code Bundle for Bug Hunting with 574 Report Patterns | news.ycombinator.com | 2026-05-20

13. RedTiger

    12 1 15 6.1 Python

    RedTiger - Automated XSS vulnerability testing tool with intelligent endpoint filtering and beautiful terminal UI

    

14. Subfind3r

    13 1 10 6.1 Python

    An improved version of Sublist3r, a python based Fast subdomains enumeration tool for penetration testers

    

15. GEMMA-by-GOOGLE

    14 2 6 6.6 Python

    GEMMA-POWERED-BY-GOOGLE-CYBERSECURITY-AUTONOMOUS-AI An autonomous AI agent using a Linux Environment using a GEMMA4-12b model. HIGHLY ABLITERATED. Fully Local-Fully FREE -WITH PERSISTENT NEG-EXPERIENCE-CACHE -LEARNING-AND GETTING SMARTER WITH EACH ENGAGEMENT. AUTONOMOUS RECON-ATTACK-LOOPS AND AUTOMATIC- PROFESSIONAL REPORT GENERATION-ON FINDINGS.

    

    Project mention: The Bug That Made My Pentesting Agent Give Up | dev.to | 2026-06-30

    What It Does · Tools · Architecture · Stack · Usage · Contributing

16. hackingpal

    15 1 4 9.3 Python

    An AI-assisted security testing workspace for authorized engagements.

    

    Project mention: Hackingpal | news.ycombinator.com | 2026-06-20

17. SpyHunt

    16 1 3 8.9 Python

    SpyHunt v4.0: A comprehensive Network Scanner & Vulnerability Assessment tool. Automate OSINT, Reconnaissance, and Bug Bounty hunting with advanced scanners (XXE, SSRF, SSTI, SQLi) plus Nuclei & Shodan integration. (Fork from @gotr00t0day) (by Pymmdrza)

    

    Project mention: SpyHunt | dev.to | 2025-12-30

    git clone https://github.com/Pymmdrza/spyhunt.git cd spyhunt pip3 install -r requirements.txt sudo python3 install.py

18. lumina

    17 1 4 5.0 Python

    ⚡ Passive OSINT reconnaissance tool — subdomains, GitHub leaks, Shodan, Wayback Machine (by surfruit)

    

    Project mention: Show HN: Lumina – passive OSINT recon tool for domains | news.ycombinator.com | 2026-02-18

19. ReconForge

    18 1 1 - Python

    

    Project mention: ReconForge – Open-Source Security Reconnaissance Toolkit | news.ycombinator.com | 2026-05-22

20. api-security-auditor-pro

    19 1 1 - Python

    Professional API security auditing tool that detects rate limiting vulnerabilities and misconfigurations in REST APIs

    

    Project mention: I got tired of manually testing API rate limits, so I built a tool | dev.to | 2026-05-30

    GitHub: miladrezanezhad/api-security-auditor-pro

21. scansearch-python

    20 2 0 5.8 Python

    Official Python SDK and CLI for ScanSearch — live internet scanning & exposure-research platform. Alternative to Shodan and Censys.

    

    Project mention: Stop Guessing What’s Public: Automating Attack Surface Discovery | dev.to | 2026-06-24

    import requests import json # Configuration API_KEY = "YOUR_SCANSEARCH_API_KEY" BASE_URL = "https://scansearch.net/api/v1" # Hypothetical API endpoint TARGET_NET = "192.168.1.0/24" # Replace with your actual public CIDR ALLOWED_PORTS = [80, 443] def fetch_exposed_services(net_range): """ Queries ScanSearch for all indexed services in a specific CIDR. """ headers = { "Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json" } # We search for the net range using the 'net' filter query = f"net:{net_range}" try: response = requests.get( f"{BASE_URL}/search", params={"q": query}, headers=headers ) response.raise_for_status() return response.json().get('results', []) except Exception as e: print(f"Error fetching data: {e}") return [] def audit_infrastructure(): print(f"--- Starting Audit for {TARGET_NET} ---") results = fetch_exposed_services(TARGET_NET) flagged_count = 0 for entry in results: ip = entry.get('ip') port = entry.get('port') service = entry.get('service', 'Unknown') if port not in ALLOWED_PORTS: print(f"[!] ALERT: Unexpected service found!") print(f" IP: {ip}") print(f" Port: {port}") print(f" Service: {service}") print(f" Banner: {entry.get('banner', 'N/A')[:50]}...") flagged_count += 1 if flagged_count == 0: print("No unexpected services found. Infrastructure looks clean.") else: print(f"Audit complete. {flagged_count} issues found.") if __name__ == "__main__": audit_infrastructure()

22. brs-kb

    21 1 0 3.2 Python

    BRS-KB is XSS Knowledge Base API

    

    Project mention: BRS-KB – open XSS knowledge base for scanners and CI | news.ycombinator.com | 2025-11-03

23. atelier-ai

    22 1 0 - Python

    Atelier AI — 7-agent autonomous income pipeline (Smart Contract Auditor + Scrape API + Landing Generator)

    

    Project mention: Building a 7-Agent Autonomous Income Pipeline in 6 Hours with Claude Code | dev.to | 2026-05-17

    Six hours later Atelier AI shipped as a 2.5k-line Python harness. This is what worked, what didn't, and how five rounds of code review turned 4 CRITICAL holes into closed pull requests.

Python bug-bounty related posts

• The Bug That Made My Pentesting Agent Give Up

  1 project | dev.to | 30 Jun 2026

• Stop Guessing What’s Public: Automating Attack Surface Discovery

  1 project | dev.to | 24 Jun 2026

• Open-source AI agent pentester chains vulnerabilities into multi-stage exploits

  1 project | news.ycombinator.com | 11 Feb 2026

• nikitastupin/clairvoyance: Obtain GraphQL API schema even if the introspection is disabled

  1 project | /r/bugbountybeginner | 8 Sep 2023

• ParaForge: A BurpSuite extension to create a custom word list of endpoints and parameters for enumeration and fuzzing

  1 project | /r/cybersecurity | 30 Jun 2023

• ParaForge: A BurpSuite extension to create a custom word-list of endpoint and parameters for enumeration and fuzzing

  1 project | /r/bag_o_news | 27 Jun 2023

• How do real hunters handle with rate-limit?

  3 projects | /r/bugbounty | 10 Mar 2023
• A note from our sponsor - SaaSHub
  www.saashub.com | 11 Jul 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Python projects with our weekly report!