Attack Surface

Your duplicate isn't a skill problem. It's a target problem.

On a swarmed program, the platform does not reward the best report. It rewards the first one. Attack Surface reads the whole bug bounty field as a live market and shows you the programs that are under-hunted, where a solid finding still lands, and the ones that are heating up, so you arrive before the swarm instead of six hours behind it. Hunt where being good still pays. Read it in your browser, pull it into your recon through the API, or get it in your inbox each morning.

Subscribe → $200 / month, USD

The board and $200 of API usage, in one subscription. Paid in crypto, or by e-transfer in Canada.

Read the tape

An example row. Momentum tells you it is heating and by how much, velocity is the report flow, crowd is who you are up against, and fresh exposure is a live lead to go look at. Every rated programme on the board reads like this, and the same fields come back from the API.

What the board answers

Crowd and competition

This is the one that kills duplicates. How many hunters are already on a programme, and how many reports each of them files. Under-hunted and still active is the combo you want: fewer people racing you means your finding is far less likely to land as a duplicate. The most congested targets do not care about your skill, they care about you being first, so this tells you which rooms are worth walking into.

Hunter count Reports per hunter Under-hunted flag

Momentum and surge

The other way to beat the swarm is to arrive before it. When a programme heats up, new scope or a launched feature just dropped, the duplicates have not piled up yet. You see the surge the day it starts, while the target is fresh, instead of once it is picked over. On a target that is filling up, being first beats being clever.

Reports per day Surge detection Trend on every row

Surface and signals

The enumerated attack surface behind each programme: subdomains, live hosts, and the signals worth a second look, like staging environments, exposed configs, and login pages. A feed shows the freshest high-value exposures as they appear, so recon is a starting point, not your whole first day.

Subdomains Live probes Exposure signals

Three ways in

The board

Scan it in your browser

Open the dashboard and read the whole field at a glance. The full rated board, every programme's drill-down, and the live exposure feed. Where to hunt tonight in about the time it takes to pour a coffee, no setup, nothing to install.

Included with every subscription

The API

Pull it into your recon

The same intelligence, on tap. Ten endpoints, priced a la carte, so you pay only for the slice you pull. Wire it into your own tooling and let your pipeline pick tonight's target, or top up a shortlist before you sit down. $200 of usage is included every month.

Read the API docs →

Daily digests

Wake up to your shortlist

Tell us the programmes and asset types you actually hunt, and a brief lands in your inbox each morning: what is heating up on your targets, the fresh exposures on their surface, and where the crowd thinned out overnight. One quiz sets it up, and it stays tuned to you.

Included · preferences rolling out

The API, metered

Your $200 a month includes $200 of API usage, counted in real dollars. A full attack-surface pull is $2.00; discovery calls are 50¢. That is roughly 100 complete program pulls, or 400 board scans, every month. When the balance runs out, calls pause until it refreshes or you top up. No credits to decode, no auto-billing, no surprises.

Terminal$0.50

curl -H "X-API-Key: bsk_live_…" \
  https://bugrater.com/api/v1/surface/programs?sort=surge

Response · one of up to 50 rows per call

{
  "id": 6596, "name": "Example Co", "platform": "hackerone",
  "rating": 71.4,
  "status": "heating", "surge_pct": 38, "trend": 1,
  "reports_per_day": 6.2, "reports_90d": 540,
  "sparkline": [388, 401, 402, 415, 447, 489, 512, 528, 540],
  "hunters": 180, "reports_per_hunter": 3.0, "crowd": "under-hunted",
  "bounty_est": 500,
  "score_drivers": { "bounty": 24, "crowding": 18, "response": 14, "freshness": 6, "surface": 9, "momentum": 5 },
  "surface": {
    "domains": 12, "wildcards": 3, "subdomains": 214, "subdomains_alive": 186,
    "signals": 41, "signals_by_type": { "staging_env": 4, "exposed_config": 9, "login_page": 2 }
  }
}

Endpoints and prices

Endpoint	Returns	Per call
Discovery · find where to look
`GET /v1/surface/programs`	Light board: rating, surge % and status, reports per day, hunters, crowd, bounty estimate. Paged and sortable.	$0.50
`GET /v1/surface/movers`	The heating-up and under-hunted lists the board leads with.	$0.50
`GET /v1/surface/signals`	A feed of the freshest high-value signals across every programme.	$0.50
`GET /v1/surface/me`	Your plan, remaining balance, and recent usage.	Free
Program intel · pull only what you want
`GET /v1/surface/programs/{id}`	Scorecard and market: composite, the six sub-scores, velocity, surge, crowd, and the sparkline.	$0.75
`GET /v1/surface/programs/{id}/subdomains`	Enumerated subdomains, each with its attached signals.	$1.00
`GET /v1/surface/programs/{id}/signals`	Just the high-value signals for one programme.	$0.75
`GET /v1/surface/programs/{id}/probes`	Live HTTP probe results.	$0.50
`GET /v1/surface/programs/{id}/velocity`	The full daily intake series, not just the sparkline.	$0.50
`GET /v1/surface/programs/{id}/full`	The full pull. Domains, signals, subdomains, probes, and scores in one call.	$2.00

What's live in the data today

Velocity and crowding run deep and live across the whole field: every rated program's report flow, surge, and hunter count, moving as the numbers move. On the surface side the scanner has already turned up over 3,000 exposed configs, 240+ staging environments, and login and admin panels across 1,800+ live-probed hosts, and it climbs every day it runs. 150+ programs are rated now, more every week. Where a figure is not in yet, the board says so instead of inventing one, because intelligence is only worth paying for if you can trust every number on it.

Questions

How does this help me avoid duplicate reports?

Duplicates cluster on crowded programs, where the platform rewards the first report, not the best one. Attack Surface flags under-hunted programs that are still active, so fewer hunters are racing you, and programs that are heating up, so you arrive before the swarm. You spend your skill where it converts instead of filing behind hundreds of other people.

What is BugRater Attack Surface?

Live intelligence on every rated bug bounty program: which are heating up as reports pour in, which are under-hunted while intake is still healthy, and what each one's attack surface is exposing right now. Read it on the board in your browser, or pull it over a metered API.

How much does it cost?

It is $200 per month in USD. That covers the full dashboard and $200 of metered API usage every month. Cancel any time, no lock-in.

How do I pay?

USDC on the Base network, which is verified automatically on-chain so access turns on within about a minute, or Canadian e-transfer, which is confirmed within 24 hours. No card and no Stripe.

What does the intelligence actually cover?

Report velocity and surge, crowding measured as hunters per program, a composite rating with its six drivers, and the enumerated attack surface: subdomains, live HTTP probes, and signals like staging environments, exposed configs, and login and admin panels.

Is there an API?

Yes. Ten read-only JSON endpoints, priced per call and metered in real dollars, with $200 of usage included each month. Each call returns a full scorecard, not a handful of fields. The full reference lives at /attack-surface/api-docs.

Who is it for?

Bug bounty hunters deciding where to spend the night, and teams wiring live program intelligence into their own recon pipelines.

Pricing

Team access

Running a crew or a small agency? One subscription covers one hunter. For a team that wants shared access and seats on the same board, reach out and we will set you up rather than have everyone buy a seat separately.

Email hello@bugrater.com with your team size.

Attack Surface

$200/ month

USD. Paid in crypto or, in Canada, by e-transfer.

The full rated board and every drill-down
Momentum, surge, and crowding on every programme
Surface, signals, and the live exposure feed
$200 of metered API usage, included
Personalized daily email digests
Cancel any time, no lock-in