Vexta · Bug Bounty & Pentest

Scan exactly what you're authorized to, and nothing more.

Import a program's scope once and Vexta enforces it as a strict allow-list on every request, DNS lookup, crawl, and browser action. Anything out of scope is refused before a packet leaves your machine, and the scan shows the exact refused count as evidence you stayed in bounds.

Start a free trial →Book a call

Example - live scan

Scope enforcement

In-scope activity vs requests refused as out of scope.

In scope

*.example.com

api.example.net

Refused as out of scope

refusedadmin.example.comexcluded in the program scope
refusedcdn.partner-example.netnot in scope
refusedsso.example.orgredirect left scope

Example. Mirrors the Scope enforcement panel on Vexta's live-scan screen; hosts and counts are placeholders.

Why it matters

Staying in scope is a requirement, not a best effort.

One out-of-scope request can get you removed from a program. Vexta does not leave scope to discipline or to a config you have to remember: it enforces the allow-list at the network layer, so a crawl that wanders, a redirect that leaves the target, or a DNS lookup for a sibling host is simply refused. You can hand the exact out-of-scope refused count to a program as proof.

Scope enforced on every request, DNS lookup, crawl, and browser action
Out-of-scope hosts are never contacted - refusals are counted and shown
Per-host rate limits and an identifying header to respect program rules
Route through an upstream HTTP/SOCKS proxy and reuse your Burp rules

How it works

Import the scope. Confirm it. Scan inside it. Report.

PoC packages, the intercepting proxy and export to HackerOne and Bugcrowd are part of Vexta Pro and Enterprise, and of the free Pro trial.

Import scope

Pull scope from Burp Suite (Target → Scope), HackerOne, or Bugcrowd, paste a plain host/URL list, or fetch a program’s published scope by handle - no re-typing allow-lists by hand.

Confirm

Review the resolved allow-list before anything runs. What is in scope and what is excluded is explicit, so there are no surprises mid-scan.

Scan within scope

Vexta scans only the authorized targets. Every request, DNS lookup, crawl step, and browser action is checked against the allow-list - out-of-scope is refused and counted.

Report

Export verified findings with PoC packages ready for HackerOne or Bugcrowd, and keep the scan's out-of-scope refused count as evidence you stayed in bounds.

Built for authorized testing

Everything you need to scan a program safely.

Import your scope the way you already track it, keep to the program rules, and route traffic however your setup requires.

Import scope from anywhere

Burp Suite (Target → Scope), HackerOne, Bugcrowd, or a plain host/URL list - or pull a program’s published scope directly by handle. No manual allow-list transcription.

Strict network-layer allow-list

Scope is enforced on every request, DNS lookup, crawl, and browser action. Nothing out of scope is ever contacted - not even via a redirect or a wandering crawl.

Refused-request evidence

Vexta records an exact count of out-of-scope requests it refused, so you have concrete compliance evidence you can hand to a program.

Per-host rate limits

Set per-host rate-limit controls and attach an identifying header so your traffic respects program rules and is attributable to you.

Upstream proxy routing

Route traffic through an upstream HTTP or SOCKS proxy, and import your Burp Match & Replace rules so requests look the way your workflow expects.

Seed from a Burp site-map

Feed Vexta a Burp site-map - including pages behind authentication - so the crawl starts from everywhere you have already walked instead of from scratch.

Bug bounty & scope enforcement - frequently asked questions

How does Vexta know what is in scope?

You import it. Vexta reads scope from Burp Suite (Target → Scope), HackerOne, or Bugcrowd, from a plain host/URL list, or by fetching a program's published scope by its handle. Whatever you import becomes the allow-list.

Can something out of scope ever get contacted by accident?

The allow-list is enforced at the network layer, so every request, DNS lookup, crawl step, and browser action is checked against it. A redirect that leaves the target, a crawl that wanders, or a lookup for a sibling host is refused before anything leaves your machine - and each refusal is counted.

Can I prove I stayed in scope?

Yes. Vexta shows an exact count of the out-of-scope requests it refused. That number is concrete evidence of in-scope behaviour you can attach to a submission or hand to a program if asked.

Can I respect a program’s rate limits?

Yes. You can set per-host rate-limit controls and attach an identifying header so your traffic stays within program rules and is attributable to you.

Does it work with my Burp setup?

Yes. Import scope from Burp Target → Scope, seed the crawl from a Burp site-map (including pages behind authentication), and import your Burp Match & Replace rules. You can also route traffic through an upstream HTTP or SOCKS proxy.

Which Vexta plan do I need?

The intercepting proxy, PoC generation and one-click export to HackerOne and Bugcrowd are part of Pro and Enterprise. The free trial is Pro, so you can try the full workflow on a real program before you buy.

Is this only for bug-bounty hunters?

No. Pentest teams working a defined engagement scope get the same strict allow-list enforcement and the same refused-request evidence - it is the same engine, just pointed at an engagement instead of a public program.

New to Vexta? See everything Vexta does →

Import your next program and scan it without crossing a line.

Start a free trial and bring in a scope today, or book a call and we will show you how the allow-list and refused-request evidence work.

Start a free trial →Book a call