BugBounty Arsenal

A free, full-stack security scanning platform for bug bounty hunters and security researchers — 50+ detectors, continuous monitoring, and CI/CD gating from a single dashboard.

▶ Live app: bugbounty-arsenal.net — free, no credit card.

If this is useful, please ⭐ the repo — it genuinely helps.

Why it's different

Most scanners run once and forget. BugBounty Arsenal keeps watching your targets and surfaces only what changed:

• 🔁 Scheduled scans — run any target daily / weekly / monthly and get an email / Slack / Discord alert only when new findings appear versus the previous run.
• 🌐 Attack Surface Management — a living inventory of every host, subdomain, technology and port your scans discover, with a NEW badge on anything that appeared this week.
• ✅ Findings triage — mark findings open / fixed / false-positive; decisions carry over to the next scan, so re-scans surface only what's genuinely new.
• 🧪 CI/CD & CLI — a stdlib-only CLI plus a GitHub Action that fails your build automatically when a new critical appears.
• 🔍 50+ detectors across 10 categories — recon, web (XSS / SQLi / SSRF / XXE / SSTI / RCE), API (JWT / IDOR / GraphQL), CVE matching, mobile (APK / IPA), and more.
• 📄 Reports in HTML / PDF / JSON / CSV, team collaboration, 2FA, and a full REST API.

Product walkthrough

1. Set the target scope and confirm you are authorized to test it.
2. Start a scan (or schedule a recurring one) and let the worker pipeline run detectors in the background.
3. Review findings, triage them, and track your attack surface over time.
4. Export the outcome, or wire the CLI / GitHub Action into your pipeline.

Quick start (Docker)

git clone https://github.com/FoxVR-sudo/Bug-Bounty-Arsenal-v.3.git
cd Bug-Bounty-Arsenal-v.3
cp .env.example .env        # set SECRET_KEY, ALLOWED_HOSTS, etc.
docker compose up -d --build
# app: http://localhost:3000  ·  api: http://localhost:8001

CI/CD & CLI

Create an API key in the app (Profile → API keys), then gate any pipeline:

# .github/workflows/security.yml
- uses: actions/checkout@v4
- uses: FoxVR-sudo/Bug-Bounty-Arsenal-v.3/.github/actions/bugbounty-scan@main
  with:
    api-key: ${{ secrets.BBA_API_KEY }}
    target: https://staging.example.com
    category: 1
    fail-on: high

Or from a terminal (Python 3, no dependencies):

export BBA_API_KEY=your_key
python cli/bba_scan.py --target https://example.com --category 1 --fail-on high

AI Fix Advisor (optional)

Every finding gets a "How to fix (AI)" button that returns tailored remediation guidance — why it matters, how to fix it (with code/config snippets), how to verify, and references. A "How to fix all (AI)" button does the whole scan at once, deduplicated by finding type so the same issue across many URLs is explained once (and cached), not generated again and again.

It's advice for you to apply, clearly labeled AI-generated with a "verify before acting" note. The tool never makes changes to the scanned target.

The feature stays off until you configure a provider — it's completely optional and safe to run without.

Stack

• Django + Django REST Framework, Celery + Redis for async scans
• React 18, React Query, React Router, Tailwind CSS
• PostgreSQL, Docker Compose
• Wraps subfinder, httpx, nuclei, dalfox, ffuf, katana, amass, nmap + custom Python detectors

Contributing & license

Contributions welcome — see CONTRIBUTING.md and CODE_OF_CONDUCT.md. Licensed under the MIT License. Use only against targets you are authorized to test.