{"id":51665998,"url":"https://github.com/geeknik/h1-numbers","last_synced_at":"2026-07-14T20:30:55.133Z","repository":{"id":356375286,"uuid":"1232076783","full_name":"geeknik/h1-numbers","owner":"geeknik","description":"Local dashboard that runs analytics on your HackerOne data.","archived":false,"fork":false,"pushed_at":"2026-05-07T19:00:03.000Z","size":16,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-03T04:33:55.758Z","etag":null,"topics":["analytics","bug-bounty","dashboard","hackerone","local-first"],"latest_commit_sha":null,"homepage":"https://deepforkcyber.com/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/geeknik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-07T15:07:35.000Z","updated_at":"2026-05-07T19:00:10.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/geeknik/h1-numbers","commit_stats":null,"previous_names":["geeknik/h1-numbers"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/geeknik/h1-numbers","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fh1-numbers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fh1-numbers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fh1-numbers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fh1-numbers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/geeknik","download_url":"https://codeload.github.com/geeknik/h1-numbers/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fh1-numbers/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35478634,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-14T02:00:06.603Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analytics","bug-bounty","dashboard","hackerone","local-first"],"created_at":"2026-07-14T20:30:52.779Z","updated_at":"2026-07-14T20:30:55.126Z","avatar_url":"https://github.com/geeknik.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# h1-numbers\n\nLocal dashboard that runs analytics on your HackerOne data.\n\nPulls from the [HackerOne hacker API](https://api.hackerone.com/getting-started-hacker-api/),\nstores everything in SQLite, and serves a small FastAPI dashboard at\n`http://127.0.0.1:8765`.\n\n## What it tracks\n\n- **You** — your reports, earnings, payouts, severity/state breakdowns,\n  monthly trends, top-paying programs, top weaknesses, recent reports.\n- **Public hacktivity** — disclosed-report sample with severity mix,\n  top paying programs, top CWEs, top reporters, monthly trends.\n- **Programs** — overview of accessible programs, bounty/open-scope counts,\n  submission-state distribution.\n\n## Setup\n\n```bash\npython3 -m venv .venv\nsource .venv/bin/activate\npip install -r requirements.txt\n```\n\nConfigure `.env` (already created — confirm your username is correct):\n\n```\nHACKERONE_API_USERNAME=your_h1_username\nHACKERONE_API_KEY=your_api_token\n```\n\nGet an API token at \u003chttps://hackerone.com/users/edit/api_tokens\u003e.\n\n## Usage\n\nFetch all your data into SQLite (first run takes a minute or two):\n\n```bash\npython -m h1n.cli fetch\n```\n\nOr fetch a single scope:\n\n```bash\npython -m h1n.cli fetch --scope my_reports,earnings\n```\n\nAvailable scopes: `my_reports`, `earnings`, `payouts`, `programs`, `hacktivity`.\n\nRun the dashboard:\n\n```bash\npython -m h1n.cli serve\n```\n\nThe server prints a refresh token at startup — paste it into the dashboard's\nrefresh-token input to trigger refetches from the UI. (Localhost-only by\ndefault; the token prevents drive-by CSRF from anything running locally.)\n\nOpen \u003chttp://127.0.0.1:8765/\u003e.\n\n\u003cimg width=\"1619\" height=\"951\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3e64942c-59f4-440f-870e-2f3350c1900b\" /\u003e\n\n## Architecture\n\n```\nh1n/\n├── client.py     httpx Basic-auth client, paginated GET, 429 backoff\n├── config.py     env loader (HACKERONE_API_*, H1N_*)\n├── db.py         SQLite schema + upserts, raw_json preserved\n├── fetcher.py    JSON:API → flat rows, scope-by-scope ETL\n├── analytics.py  read-only SQL queries\n├── server.py     FastAPI routes + background refresh\n└── cli.py        `python -m h1n.cli {fetch,serve,status}`\n\nfrontend/\n├── index.html    tabs: My reports / Hacktivity / Programs\n├── app.js        Chart.js charts, table rendering, refresh trigger\n└── styles.css    dark theme\n\ndata/h1.db        SQLite (auto-created, gitignored)\n```\n\n## Hardening notes\n\n- `.env` is gitignored. Token is loaded once via `python-dotenv`,\n  passed only to `httpx.BasicAuth`, never logged.\n- `client.py` strips error details so credentials never end up in logs.\n- Server binds `127.0.0.1` by default. `/api/refresh` requires a\n  per-process token (printed at startup, hashed-compared) to prevent\n  any local browser from triggering an unauthenticated fetch.\n- All SQL uses parameterized queries; user-controlled `limit` values\n  are clamped before formatting.\n- `H1N_HACKTIVITY_MAX_PAGES` and `H1N_PROGRAMS_MAX_PAGES` bound\n  ingestion size — hacktivity is huge; you want a sample, not the firehose.\n- Pagination is bounded at the client; pages are clamped to ≤100 items\n  (HackerOne's max), and a small sleep between pages stays well below\n  the 600 reads/min limit.\n\n## Re-fetching\n\nEach `fetch` upserts by id, so subsequent runs are incremental updates.\nA scheduled cron / launchd job hitting `python -m h1n.cli fetch` daily\nwill keep the dashboard fresh.\n\n### Hacktivity specifics\n\nThe hacktivity API has two hard limits:\n\n- Page size caps at ~50 (we ask for 100 anyway).\n- Pagination depth caps at \u003c100 pages — a single linear walk reaches\n  ~5000 newest disclosures, which is roughly mid-2017 to today.\n\nThe fetcher mitigates both:\n\n- **Watermark.** On every non-`--full` run, `fetch_hacktivity` reads\n  `MAX(disclosed_at)` from SQLite and adds `disclosed_at:\u003e=YYYY-MM-DD`\n  (with one day of overlap) to the Lucene query, so daily refreshes\n  only pull what's new.\n- **`--full` flag.** Bypasses the watermark and re-paginates from the\n  newest disclosure to the API depth cap. Use after a long pause or\n  to verify completeness:\n\n  ```bash\n  python -m h1n.cli fetch --scope hacktivity --full --hacktivity-max-pages 99\n  ```\n\n  Takes ~80s for ~4950 items.\n\nThe dashboard's refresh button has the same `full` toggle.\n\n## License\n\n[Apache License 2.0](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgeeknik%2Fh1-numbers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgeeknik%2Fh1-numbers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgeeknik%2Fh1-numbers/lists"}