Vexta's Bug Bounty Report Submission to HackerOne and Bugcrowd

Bug bounty report submission means getting a confirmed finding from a scanner or notes file into a platform's intake system in the format that platform expects, with scope and program details already verified. Vexta, VITI Security's agentless, AI-augmented vulnerability scanner and pentest platform, connects to HackerOne and Bugcrowd directly, so scope import, submission, and program browsing happen inside the same tool that found and verified the bug.

The problem: context-switching between scanner and platform

A typical bug bounty session involves at least three tools: something to scan and probe with, a notes system to track findings, and a browser tab open to the platform to check scope, look up program details, and eventually submit. Every switch between them is a chance to misread scope, submit against a program that just changed its rules, or lose track of which findings are already reported.

The scope question in particular costs hunters time they do not get back. A program's in-scope assets can change, and testing or reporting against something that just got pulled from scope wastes a report and, worse, can jeopardize a hunter's standing on a platform.

How does Vexta connect to HackerOne and Bugcrowd?

Vexta's bounty integration lives under a dedicated "Bounty Integrations" tab in Configuration, with masked API-key inputs for each platform and a live Test Connection button. The test hits the platform's own account-verification endpoint and returns a clear pass or fail, so a hunter knows immediately if a key is valid rather than discovering it fails at submission time.

For HackerOne, Vexta supports scope import and automated report submission. For Bugcrowd, it supports scope import and submission through Bugcrowd's API. Credentials are saved to local configuration once entered and are not re-entered per scan.

Exporting a finding once it's ready

Once a finding has gone through Vexta's proof-of-exploitation step and has its proof-of-concept package attached, curl command, raw HTTP request, evidence, and a CVSS vector, it becomes eligible for one-click export to HackerOne, Bugcrowd, or plain Markdown. The export carries the reproduction package into the platform's format rather than asking a hunter to retype the request or reformat the severity score by hand.

That sequencing matters: submission only makes sense once a finding is confirmed, which is why export sits downstream of verification rather than being available for every raw scan result.

Why does the programs page load instantly?

Vexta's `/bounty` page reads from a local SQLite cache of program data rather than calling HackerOne or Bugcrowd every time a hunter opens it. Page loads never hit the upstream APIs directly, which means browsing programs, checking scope, or comparing reward ranges is fast and does not compete with a platform's own rate limits.

Refreshing that cache is operator-triggered rather than automatic on every page load: a refresh action fetches the current program list per platform, then enriches details concurrently across multiple worker threads before writing the results back to the cache. For HackerOne, the list comes from the programs endpoint sorted by acceptance date, with a per-program lookup for reward ranges on paid programs, since the list endpoint itself does not expose that detail. Bugcrowd programs come from its own briefs endpoint.

Browsing and filtering programs

The programs UI offers a grid view or a table view, sidebar filters for program type, platform, status, and minimum reward, plus quick-filter chips and paginated loading. Reward ranges display distinctly depending on what the platform publishes: a visible range for paid programs, a muted label for disclosure-only programs with no bounty, and a separate label when a program does not expose a public reward table at all.

That distinction saves a hunter from opening a program page just to learn it is disclosure-only, or from assuming a program has no reward when the range simply is not published. For a hunter deciding where to spend the next few hours, filtering by minimum reward and program status up front means fewer wasted clicks into programs that turn out to be a poor fit.

Because HackerOne's list endpoint does not include the reward range itself, Vexta's refresh step makes a second, per-program lookup for paid programs specifically to pull that detail. Running that lookup across eight concurrent workers during a refresh keeps the wait for a full re-sync reasonable even when a hunter tracks a large number of programs across both platforms.

Key takeaways

The practical effect of combining scope import, submission, and a cached programs view in one tool is fewer places for a mistake to creep in. A hunter checking scope inside Vexta before testing is checking the same source Vexta will use when it submits the eventual report, rather than cross-referencing a browser tab against scan configuration by memory. None of this replaces reading a program's actual policy and staying inside its rules; scope import and the cached programs list are conveniences for tracking what a program has published, not a substitute for the program's own terms.