BugBounty Arsenal
A free, self-hostable security scanner that checks web apps, mobile apps, and smart contracts for vulnerabilities, with AI-written fix instructions.
🔗 Visit BugBounty Arsenal
Description
If you've wanted the kind of vulnerability scanning that commercial tools like Burp Suite Pro or Acunetix offer, but without the license fee, BugBounty Arsenal packages a broad set of security checks — over 60 detectors covering injection attacks, misconfigurations, exposed secrets, and known CVEs — into a free, self-hosted, open-source scanner. Every finding is mapped to the OWASP Top 10 with a CVSS score, and rather than leaving you to figure out what to do about it, an "AI Fix Advisor" writes step-by-step remediation guidance for each issue.
It goes beyond typical web scanners in two directions: static analysis of Android/iOS mobile apps for hardcoded secrets and weak crypto, and Solidity smart-contract analysis across 28 vulnerability classes for Web3 projects. It also has an unusual gamified mode — a "Red vs Blue Arena" where one side writes offensive detectors and the other defensive ones, scored in real time. Practically, it's built for teams: scheduled/continuous scanning, an attack-surface inventory that tracks new hosts and subdomains weekly, CI/CD integration that can fail a build on new critical findings, and self-hosting via a single Docker Compose command.
💬 Our review
The short version: BugBounty Arsenal packs an unusually wide feature set — web, mobile, and Web3 scanning, plus CI/CD gating — into a free, self-hosted tool built and maintained by a small, active solo/small-team project, and that combination of ambition and small-team maintenance is the main thing to weigh before adopting it.
Against OWASP ZAP or Burp Suite Community, it covers noticeably more ground out of the box (mobile static analysis, smart-contract scanning, AI-written fix guidance) without a license fee, and its "Confirmed" findings model — only flagging issues with direct proof like an out-of-band callback or CVE match — should mean fewer false positives to wade through than a raw scanner dump. The trade-off is maturity: with roughly a dozen GitHub stars and one core maintainer, you're relying on a young, unproven project for something as consequential as a security pipeline gate, and support is community-only rather than commercial. Worth it if you want broad, free coverage for a side project, startup, or internal audit and are comfortable self-hosting via Docker; skip it for a compliance-critical pipeline where you need vendor support and a longer track record, where OWASP ZAP (backed by a larger community) or a paid tool like Burp Suite Pro will feel safer.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit, toutes les fonctionnalités incluses (web, mobile, Web3, scans planifiés, Arena). Auto-hébergement gratuit via Docker Compose.
Pros
Couverture large (web, mobile, smart contracts) sans frais de licence
Modèle 'Confirmed' qui réduit les faux positifs
Guide de correctif généré par IA pour chaque faille
Auto-hébergeable gratuitement via Docker, intégration CI/CD
Cons
Projet jeune (~12 étoiles GitHub), maintenu par une petite équipe/solo
Support communautaire uniquement, pas de SLA commercial
Analyse mobile statique uniquement, pas de test dynamique
Nécessite des connaissances Docker/DevOps pour l'auto-hébergement