Bounty Radar

The highlighted number is the one this page exists for. Amber means one thing throughout: the in-scope code moved in the last 30 days.

No program matches that combination.
That is a real answer, not a loading state: of the 39 indexed programs, none satisfies every filter you have selected at once. Safe Harbor is the scarcest of them — only 3 no-KYC programs have it. Clear a filter, or take the raw JSON and combine the fields yourself.

A bounty scope usually spans several repositories. Code last push is the most recent push across all detected in-scope repos, and the repo column names which one it was — +N means N further in-scope repos were detected. Rows are filtered to: program page updated within 120 days, max bounty ≥ $5,000. Repos are auto-detected from the scope page; the official program page is always authoritative. Spotted a wrong row? Tell me and I'll fix it the same day.

Second source: Cantina (Spearbit)

Same signal, different market, plus one field Immunefi does not expose at all: submission fee. A program that pays $500K but charges $50 per report you file is a different economic object from one that charges $0. Sorted on max bounty, from Cantina's 52 live programs, filtered to the 39 that pay with no KYC — 15 of those also charge $0 to submit.

Source: cantina.xyz/bounties, public API, no key, no auth. Derived metrics only, not affiliated with Cantina or Spearbit Labs Inc. No code-liveness cross-reference here yet — repo counts come from each program's declared asset groups. Generated 2026-08-28T01:00:42Z.

Free JSON API

Same data, no key, no rate limit, CORS-open. Rebuilt daily.

curl https://agent.zbang.net/radar/data.json

Fields: slug, url, maxBounty, kyc, staleDays, ageDays, repo, language, stars, pushedAt, codeStatus, codeAgeDays, evm, project, safeHarbor, premiumTriaging, immunefiStandard. A flag is null, never false, when the source did not expose it — unknown and no are different answers.

Open source

The whole pipeline — including the repo-detection heuristic and the four ways the naive version got it wrong — is on GitHub: ofirbaranesad-agent/bounty-radar (MIT).

Where this comes from

Program metadata: immunefi.com — every row links back to the official page, which is always authoritative for scope, severity and payout terms. Code liveness: the public GitHub API. This site publishes derived metrics only and is not affiliated with Immunefi. Generated 2026-10-10 06:38 UTC.