Skip to content

fix(intigriti): filter No-Bounty tier targets in --bbp-only mode - #105

Open
proabiral wants to merge 1 commit into
sw33tLie:mainfrom
proabiral:intigriti_fix_bbpOnly
Open

fix(intigriti): filter No-Bounty tier targets in --bbp-only mode#105
proabiral wants to merge 1 commit into
sw33tLie:mainfrom
proabiral:intigriti_fix_bbpOnly

Conversation

@proabiral

@proabiral proabiral commented Sep 1, 2026

Copy link
Copy Markdown

Problem

With -b / --bbp-only, the Intigriti poller returns assets whose individual tier is "No Bounty", as long as the program offers a bounty on some other tier. For example, *.rosenbergertechnologies.com (tier "No Bounty") is pulled from the Rosenberger Group program because that program's overall maxBounty is non-zero.

Root cause

opts.BountyOnly is applied only at the program-listing level in ListProgramHandles (maxBounty != 0), which merely decides whether a program is fetched at all. Inside FetchProgramScope, every in-scope asset is emitted regardless of its tier — the per-program isBBP flag is computed but only stored as metadata, never used to filter output.

The v1 code had a per-target guard (tierID != 1); it was dropped in the v2 refactor. The hackerone and yeswehack pollers still filter per target.

Fix

Skip individual "No Bounty" tier targets when BountyOnly is set, keyed off the same tierValue == "No Bounty" string the surrounding code already uses to compute isBBP.

if tierID != 5 { // Not out-of-scope
    if opts.BountyOnly && tierValue == "No Bounty" {
        return true
    }
    ...

FetchProgramScope emitted every in-scope asset regardless of tier. The
program-level maxBounty filter in ListProgramHandles only decides whether a
program is fetched, so programs with any paid tier leaked their "No Bounty"
assets when -b/--bbp-only was set (e.g. *.rosenbergertechnologies.com in the
Rosenberger Group program).

Skip individual "No Bounty" tier targets when BountyOnly is set, restoring the
per-target behaviour v1 had and matching the hackerone/yeswehack pollers.
@proabiral proabiral closed this Sep 1, 2026
@proabiral proabiral reopened this Sep 1, 2026
@sw33tLie

sw33tLie commented Sep 2, 2026

Copy link
Copy Markdown
Owner

Thanks - checking soon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants