scope is a CLI tool and curated dataset for querying bug bounty program scopes across multiple platforms (Bugcrowd, HackerOne, Intigriti, YesWeHack). It helps security researchers quickly find which programs have specific domains or assets in scope.
- Automated data: Scope data fetched and updated every 10 minutes from popular bug bounty platforms
- CLI tool: A simple command to search programs by target (e.g.,
scope *.tidal.com) - Categorized files: Wildcards, domains, and GitHub repos separated by platform and scope type
-
- newdata_inscope_wildcards.txt - Contains wildcard patterns (e.g.,
*.example.com) for matching subdomains
- newdata_inscope_wildcards.txt - Contains wildcard patterns (e.g.,
-
- newdata_inscope_domains.txt - Contains full domain names (e.g.,
api.example.com)
- newdata_inscope_domains.txt - Contains full domain names (e.g.,
-
- newdata_inscope_github_repo.txt - Contains GitHub repository URLs (e.g.,
https://github.com/org/repo)
- newdata_inscope_github_repo.txt - Contains GitHub repository URLs (e.g.,
-
- inscope.txt - Combined list of all in-scope targets (wildcards + domains + GitHub repos)
-
- outofscope.txt - Combined list of all out-of-scope targets to exclude
-
- inscope_wildcards.txt - All in-scope wildcard patterns
- outofscope_wildcards.txt - Wildcard patterns explicitly out of scope
-
- inscope_domains.txt - All in-scope full domains
- outofscope_domains.txt - Domains explicitly out of scope
-
- inscope_github_repo.txt - All in-scope GitHub repositories
- outofscope_github_repo.txt - GitHub repositories explicitly out of scope
-
-
bugcrowd_inscope.txt - In-scope targets from Bugcrowd programs
-
bugcrowd_outofscope.txt - Out-of-scope targets from Bugcrowd programs
-
bugcrowd_github_repo_inscope.txt - In-scope GitHub repos from Bugcrowd
-
bugcrowd_github_repo_outofscope.txt - Out-of-scope GitHub repos from Bugcrowd
-
-
-
hackerone_inscope.txt - In-scope targets from HackerOne programs
-
hackerone_outofscope.txt - Out-of-scope targets from HackerOne programs
-
hackerone_github_repo_inscope.txt - In-scope GitHub repos from HackerOne
-
hackerone_github_repo_outofscope.txt - Out-of-scope GitHub repos from HackerOne
-
-
-
intigriti_inscope.txt - In-scope targets from Intigriti programs
-
intigriti_outofscope.txt - Out-of-scope targets from Intigriti programs
-
intigriti_github_repo_inscope.txt - In-scope GitHub repos from Intigriti
-
intigriti_github_repo_outofscope.txt - Out-of-scope GitHub repos from Intigriti
-
-
-
yeswehack_inscope.txt - In-scope targets from YesWeHack programs
-
yeswehack_outofscope.txt - Out-of-scope targets from YesWeHack programs
-
yeswehack_github_repo_inscope.txt - In-scope GitHub repos from YesWeHack
-
yeswehack_github_repo_outofscope.txt - Out-of-scope GitHub repos from YesWeHack
-
You can improve these regex for more accurate data.
Install the scope CLI tool with a single command:
wget -q -O /usr/bin/scope https://raw.githubusercontent.com/rix4uni/scope/refs/heads/main/scope && chmod +x /usr/bin/scopeSearch for bug bounty programs by domain, wildcard, or asset:
▶ scope *.tidal.com { "name": "TIDAL", "url": "https://bugcrowd.com/engagements/tidal-bugbounty", "allows_disclosure": true, "managed_by_bugcrowd": true, "safe_harbor": "full", "max_payout": 5000, "targets": { "in_scope": [ { "type": "website", "target": "https://tidal.com/", "uri": "https://tidal.com/", "name": "*.tidal.com", "ipAddress": null }, { "type": "website", "target": "*.wimpmusic.com", "uri": "", "name": "*.wimpmusic.com", "ipAddress": null }, { "type": "website", "target": "*.tidalhifi.com", "uri": "", "name": "*.tidalhifi.com", "ipAddress": null }, { "type": "api", "target": "api.tidal.com", "uri": "", "name": "api.tidal.com", "ipAddress": null }, { "type": "website", "target": "*tidalhi.fi", "uri": "", "name": "*tidalhi.fi", "ipAddress": null }, { "type": "website", "target": "*.tdl.sh", "uri": "", "name": "*.tdl.sh", "ipAddress": null }, { "type": "ios", "target": "Tidal Client for iOS", "uri": "", "name": "Tidal Client for iOS", "ipAddress": null }, { "type": "android", "target": "Tidal Client for Android", "uri": "", "name": "Tidal Client for Android", "ipAddress": null }, { "type": "other", "target": "https://offer.tidal.com/download", "uri": "https://offer.tidal.com/download", "name": "Tidal Desktop Client", "ipAddress": null }, { "type": "other", "target": "Tidal Official Clients (e.g. Sonos integration, Tesla integration, etc.)", "uri": "", "name": "Tidal Official Clients (e.g. Sonos integration, Tesla integration, etc.)", "ipAddress": null } ], "out_of_scope": [ { "type": "other", "target": "https://developer.tidal.com", "uri": "https://developer.tidal.com", "name": "developer.tidal.com", "ipAddress": "" }, { "type": "other", "target": "https://embed.tidal.com", "uri": "https://embed.tidal.com", "name": "embed.tidal.com", "ipAddress": "" } ] } }
▶ scope *.gov.sg { "id": "govtech-vulnerability-disclosure-programme-policy", "name": "GovTech - Vulnerability Disclosure Programme", "public": true, "disabled": false, "managed": null, "min_bounty": null, "max_bounty": null, "targets": { "in_scope": [ { "target": "*.gov.sg", "type": "other" }, { "target": "Domains where GovTech is the registrar", "type": "other" } ], "out_of_scope": [ { "target": "All domains or subdomains not listed in the above list of 'Scopes'", "type": "other" } ] } }
The tool searches across all supported platforms (Bugcrowd, HackerOne, Intigriti, YesWeHack) and returns complete program details including in-scope and out-of-scope targets.