Docs for building your security research workflows.
Find the shortest path from a workflow idea to a running scan, with references for self-hosted runners, payloads, storage, notifications, datasets, and the CLI close at hand.
Documentation map
Choose what you are working on
The homepage is now a launchpad: start with workflows, then jump to the supporting system you need next.
Workflows
Define programmable security research workflows in a typed, Starlark-based language.
Modules
Package reusable recon phases with explicit input/output contracts.
Runners
Set up the execution layer that runs your scans.
Datasets
Query accumulated scan observations with DuckDB SQL, filters, and saved views.
Bhlast Servers
Run collaborator-style DNS and HTTP infrastructure.
Notifications
Send useful signals when workflow events matter.
Blob Storage
Store and review artifacts produced by automation.
Payloads
Create reusable inputs for repeatable testing.
CVE Watcher
Track known exploited vulnerabilities with CVSS, EPSS, and exploit signals.
Developer
Use API scopes and integrations from your tools.
BH CLI
Drive common BountyHub tasks from the terminal.
Need to talk to someone?
Get unstuck without leaving the docs.
If the workflow path does not answer it, support and the community are one click away.