Attack Surface

Your duplicates aren't a skill issue. They're a timing issue.

On a crowded program, the first report of a bug is the one that gets paid. Attack Surface tracks report volume and hunter counts across bug bounty programs. It shows you which programs are under-hunted, so a solid finding is less likely to be a duplicate, and which are heating up, so you can get there early. Use it in your browser, through the API, or as an email each morning.

Subscribe $200 / month, USD

Includes the board and $200 of API usage. Pay in crypto, or by e-transfer in Canada.

What a board row looks like

Momentum shows whether reports are rising and by how much. Velocity is reports per day. Crowd is how many hunters you are competing with. Fresh exposure is a recently found host worth checking. Every rated program on the board has a row like this, and the API returns the same fields.

What the board shows

Crowd and competition

This shows how many hunters are already on a program, and how many reports each one files. Look for programs that are under-hunted and still active. With fewer people looking, your finding is much less likely to be a duplicate.

Hunter count Reports per hunter Under-hunted flag

Momentum and surge

A jump in reports usually means new scope or a new feature went live recently, and duplicates have not piled up yet. The board shows the surge on the day it starts, while the target is still fresh.

Reports per day Surge detection Trend on every row

Surface and signals

We enumerate the attack surface of each program. That includes subdomains, live hosts, and signals worth a second look, like staging environments, exposed configs and login pages. A feed shows the newest high-value exposures as they appear, which saves you some of the early recon.

Subdomains Live probes Exposure signals

Three ways to use it

The board

In your browser

The dashboard has the full rated board, a drill-down for every program, and the live exposure feed. It runs in your browser with nothing to install.

Included with every subscription

The API

In your own tools

The same data over an API. There are ten endpoints, each priced per call, so you pay only for what you request. Hook it into your scripts to pick targets or build a shortlist. $200 of usage is included every month.

Read the API docs

Daily digests

In your inbox

Tell us which programs and asset types you hunt, and we email you a brief each morning. It covers what is heating up on your targets, new exposures on their surface, and where the crowd thinned out overnight. You set it up once with a short quiz.

Included. Preference settings are still rolling out.

API pricing

Your $200 a month includes $200 of API usage, counted in dollars. A full attack-surface pull costs $2.00 and discovery calls cost 50¢. That works out to about 100 full program pulls or 400 board scans a month. When the balance runs out, calls pause until it refreshes or you top up. There are no credits and no automatic charges.

Request$0.50

curl -H "X-API-Key: bsk_live_…" \
  https://bugrater.com/api/v1/surface/programs?sort=surge

Response (one row, up to 50 per call)

{
  "id": 6596, "name": "Example Co", "platform": "hackerone",
  "rating": 71.4,
  "status": "heating", "surge_pct": 38, "trend": 1,
  "reports_per_day": 6.2, "reports_90d": 540,
  "sparkline": [388, 401, 402, 415, 447, 489, 512, 528, 540],
  "hunters": 180, "reports_per_hunter": 3.0, "crowd": "under-hunted",
  "bounty_est": 500,
  "score_drivers": { "bounty": 24, "crowding": 18, "response": 14, "freshness": 6, "surface": 9, "momentum": 5 },
  "surface": {
    "domains": 12, "wildcards": 3, "subdomains": 214, "subdomains_alive": 186,
    "signals": 41, "signals_by_type": { "staging_env": 4, "exposed_config": 9, "login_page": 2 }
  }
}

Endpoints and prices

Endpoint	Returns	Per call
Discovery
`GET /v1/surface/programs`	Board rows with rating, surge % and status, reports per day, hunters, crowd and bounty estimate. You can page and sort the results.	$0.50
`GET /v1/surface/movers`	The heating-up and under-hunted lists from the top of the board.	$0.50
`GET /v1/surface/signals`	The newest high-value signals across all programs.	$0.50
`GET /v1/surface/me`	Your plan, remaining balance, and recent usage.	Free
One program
`GET /v1/surface/programs/{id}`	The scorecard and market data: composite score, the six sub-scores, velocity, surge, crowd and the sparkline.	$0.75
`GET /v1/surface/programs/{id}/subdomains`	Enumerated subdomains and the signals attached to each.	$1.00
`GET /v1/surface/programs/{id}/signals`	The high-value signals for one program.	$0.75
`GET /v1/surface/programs/{id}/probes`	Live HTTP probe results.	$0.50
`GET /v1/surface/programs/{id}/velocity`	The full daily intake series that the sparkline is drawn from.	$0.50
`GET /v1/surface/programs/{id}/full`	Domains, signals, subdomains, probes and scores, all in one call.	$2.00

What's in the data today

Velocity and crowding data covers every rated program. That means report flow, surge and hunter count, updated as the numbers change. On the surface side, the scanner has found over 3,000 exposed configs, 240+ staging environments, and login and admin panels across 1,800+ live-probed hosts. Those counts grow every day the scanner runs. 150+ programs are rated now, with more added every week. Where a figure isn't in yet, the board says so. We don't fill the gap with a guess.

Questions

How does this help me avoid duplicate reports?

Duplicates cluster on crowded programs, where the platform rewards the first report, not the best one. Attack Surface flags under-hunted programs that are still active, so fewer hunters are racing you, and programs that are heating up, so you arrive before the swarm. You spend your skill where it converts instead of filing behind hundreds of other people.

What is BugRater Attack Surface?

Live intelligence on every rated bug bounty program: which are heating up as reports pour in, which are under-hunted while intake is still healthy, and what each one's attack surface is exposing right now. Read it on the board in your browser, or pull it over a metered API.

How much does it cost?

It is $200 per month in USD. That covers the full dashboard and $200 of metered API usage every month. Cancel any time, no lock-in.

How do I pay?

USDC on the Base network, which is verified automatically on-chain so access turns on within about a minute, or Canadian e-transfer, which is confirmed within 24 hours. No card and no Stripe.

What does the intelligence actually cover?

Report velocity and surge, crowding measured as hunters per program, a composite rating with its six drivers, and the enumerated attack surface: subdomains, live HTTP probes, and signals like staging environments, exposed configs, and login and admin panels.

Is there an API?

Yes. Ten read-only JSON endpoints, priced per call and metered in real dollars, with $200 of usage included each month. Each call returns a full scorecard, not a handful of fields. The full reference lives at /attack-surface/api-docs.

Who is it for?

Bug bounty hunters deciding where to spend the night, and teams wiring live program intelligence into their own recon pipelines.

Pricing

Team access

One subscription covers one hunter. If you run a team or a small agency and want shared access to the same board, get in touch and we will set up seats for your team.

Email hello@bugrater.com with your team size.

Attack Surface

$200/ month

USD. Pay in crypto, or by e-transfer in Canada.

The full rated board and every drill-down
Momentum, surge, and crowding on every program
Surface, signals, and the live exposure feed
$200 of metered API usage, included
Personalized daily email digests
Cancel any time