60+ detectors for web, plus mobile apps and smart contracts. Every finding is mapped to the OWASP Top 10, marked Confirmed when we have proof, and comes with AI fix guidance — plus scheduled scans, the Red vs Blue Arena, branded PDF reports and CI/CD gating. Free, open-source and self-hostable.

Hi Product Hunt 👋 I built BugBounty Arsenal because paid scanners (Detectify, Intruder…) cost hundreds a month, and one-off free scanners don't tell you what CHANGED between runs. So this one focuses on continuous monitoring: schedule a target, and it only pings you when something NEW shows up — plus attack-surface tracking, triage that carries over, and a CLI/GitHub Action for CI. It's genuinely free and open source. I'd love your feedback on the detection quality and the continuous-scanning flow. Happy to answer anything!

Hey Product Hunt 👋

I'm a solo dev and I've been building BugBounty Arsenal in the open. The idea started simple: a scanner shouldn't just dump findings on you and walk away.

So the last few weeks I added an AI advisor that, for every finding, tells you how to fix it (with code/config) and — for authorized testing — how to reproduce it for your report. It's guidance for you to apply, never changes to the target.

I also added a live feed of newly launched bug bounty programs right on the homepage, because half the game is being early.

And I did a big false-positive cleanup pass — a real scan that used to return 100 noisy "highs" now returns a handful of real findings.

It's free, open-source and self-hostable. I'd love brutal feedback: what's noisy, what's missing, what would make it part of your workflow?

Thanks for taking a look 🙏