Bug Bounty Recon Pipeline

Stand up an automated recon pipeline that surfaces new attack surface as it appears.

When to Use

• You are starting a bug bounty program and need a repeatable recon workflow
• You want to detect changes (new subdomains, ports, endpoints) over time

Pipeline Stages

1. Scope Ingestion

• Parse program scope from the policy page; store exact in-scope patterns (*.example.com vs example.com)
• Reject anything out of scope at query time, not by memory

2. Subdomain Enumeration