BountyHub Docs
Configuration References
Refer to variables, secrets, and MCP servers with config.* without embedding values in workflows.
Workflows should describe what to do, not carry the credentials and settings
needed to do it. The config namespace references external configuration; the
platform resolves the effective values at execution time.
#References
| Reference | Meaning | Types as |
|---|---|---|
config.var("name") | A configuration variable (e.g. a target domain, a severity filter) | string |
config.secret("name") | A secret (API keys, tokens) | string |
config.mcp("name") | A configured MCP server connection for agent steps | MCP ref |
The scope of a name — global, organization, project, or environment — is managed by the platform. Your workflow stays identical across environments; only the configuration differs.
#Secrets Are Never Serialized
Only the reference is stored — in the workflow definition, the AST, the serialized steps, execution state, and logs. Secret values are resolved at execution time and never written anywhere your workflow can leak them:
What gets stored is config.secret("pushover_token") — not the token itself.
Sensitivity propagates through composition: anything derived from a secret
(concatenation, trimming, casing) is still treated as sensitive.
#Lazy Strings Compose
Config references are lazy strings: they type as string but hold an
expression tree that evaluates at execution time. You can compose them freely:
Because these are references, changing the target domain for a program is a configuration change — not an edit to every workflow you own.
#Realistic Configuration Layout
A typical hunting setup keeps per-program settings in configuration:
| Config name | Example use |
|---|---|
target_domain | "acme-example.com" — passed to subfinder, httpx, nuclei |
program | Program slug recorded into datasets as provenance |
nuclei_severity | "critical,high" — tune without editing workflows |
slack_webhook / notification tokens (secret) | Where findings get announced |
github_token (secret) | For agents using the GitHub MCP server |
The same workflow runs against any program: point target_domain and program
at different values and clone it per target.
#Names
Reference names must be non-empty after trimming. Unknown or unresolved names surface at execution time with a clear error, so typos fail loudly instead of silently scanning the wrong thing.