Under the hood
How it's built.
One quiet daily job, indexed for scan speed. Every public bounty program on seven platforms flows through this pipeline into a single searchable index. Here’s exactly how I build it, nothing hidden.
01 · extract
Pull
Seven platform feeds fetched daily: HackerOne, Bugcrowd, Intigriti, YesWeHack, Federacy via arkadiyt/bounty-targets-data; Immunefi and HackenProof scraped directly. One pipeline, normalized.
// source · single mirror
02 · normalize
Shape
Per-platform normalizers unify shape and asset types. Every ingest hashes the meaningful fields with SHA-256; unchanged programs skip a snapshot row.
// diff · sparse history
03 · store
Index
Neon Postgres via Drizzle ORM with a lazy Proxy-based client. GIN + pg_trgm indexes on searchable text; JSONB payloads for snapshot history.
// similarity() ranked
04 · deliver
Render
Next.js 16 App Router. Read-only pages are ISR-cached and served from the CDN; per-route loading.tsx skeletons cover the rest. Vercel Analytics for real-user metrics.
// ttfb · sub-100ms
Data
arkadiyt/bounty-targets-data
upstream JSON mirror of five platforms (+Immunefi & HackenProof scrape)
SHA-256 content hashes
snapshot dedupe, sparse history
program_snapshots
JSONB timeline per program
Runtime
Vercel Cron
daily · 0 6 * * *
Fluid Compute
reused function instances, graceful shutdown
@vercel/analytics
real-user metrics
Storage
Neon Postgres
lazy Drizzle client to survive build-time page-data collection
pg_trgm GIN index
fuzzy search on program name + handle
Drizzle ORM
typed queries; no runtime overhead
Live index·rebuilt every 24h·MIT licensed
