Most "bounty aggregators" are one GitHub search away from being a scam pipe. Filter on label:bounty and roughly 40% of what you surface is an engagement farm paying vanity tokens for starring a repo. GitScout exists to be the opposite: a small feed you can trust over a large feed you cannot. This is the report on building that moat — and on the day the moat proved its own worth by telling me a bounty wasn't worth chasing.
01What I set out to do
Two approved objectives, in order. Aggregator first: aggregate real bounties and reject farms and scams, linking every item to its source of truth. Shortlist in parallel: produce a shortlist of realistic paying bounties matched to my stack — Python / FastAPI / Next.js — then go one level deeper on the single best candidate: pull the live issue, confirm the payout, confirm it's unassigned, and scope the fix.
This report covers the deep-dive and folds its findings back into the aggregator.
02The procedure
Four steps, each feeding the next:
- Built and unit-tested a trust filter — the aggregator moat — that rejects farm/scam bounties with no network call, then escalates survivors to a reputation gate.
- Ran a live, trust-filtered GitHub scrape of the real paying markers (
algora.io in:body,Funding on Polar in:body, the💎 Bountylabel), producing an 18-candidate shortlist from 41 raw hits. - Deep-dived four candidates in the live UI to confirm amounts, rules, and — decisively — the competition.
- Reframed the strategy around what the data actually showed.
03What the live data showed
I executed discovery for real, reading each candidate straight from the Algora and GitHub UIs on 2026-09-03. The table is the whole argument:
| Issue | Amount | State | Attempts | Reality |
|---|---|---|---|---|
onyx-dot-app/onyx#2281 | $250 | Open since Oct 2024, unrewarded | 40+ | Maintainer-approved, yet a two-year graveyard. |
tscircuit/pcb-viewer#163 | $3 | Open | 40+ | Lead attempter has 59 completed tscircuit bounties. |
tscircuit/jlcsearch#92 | $1 | Open | 103 claims | Micro-value, maximally swarmed. |
tscircuit/template-api-fake#2 | $12 | Already Rewarded, still Open | 18+ | People "start" a bounty that was already paid out. |
The whole tscircuit org board: 10 open / 707 completed. The open remainder is picked-over — old, tiny ($1–$170), heavily claimed. Opire, the less-crowded fallback I wanted, was returning HTTP 502 at check time — a live lesson in not single-sourcing discovery.
Two temptations were on the table, and both were refused. Attempting a saturated issue anyway to produce a "win" narrative — rejected, because expected value is ~$0 and a rushed AI PR into a repo that explicitly closes low-quality AI PRs would damage real reputation. And writing up a claim that never happened — rejected outright, because fabricating a completed bounty is precisely the fraud GitScout exists to detect.
04Why the failure strengthens the product
The deep-dive exposed a second axis of worthlessness beyond scams. A bounty wastes your time for either of two independent reasons:
GitScout already solves the first. The live data proves it must also score the second — a viability signal: attempt density, an already-rewarded flag, veteran lock-in, staleness, newcomer-eligibility. The output is one verdict — "realistic for a newcomer? yes/no + why" — layered on top of "is it a scam? yes/no." That's a defensible product insight that fell out of an honest failure, not a consolation prize.
05Contingencies considered, and what I did about them
| Risk | Mitigation actually taken |
|---|---|
| Scam/farm bounties re-hosted as payable | Permanent blocklist, numeric-owner heuristic, junk-title filter, star gate, engagement/vanity-token gate. 11/11 unit tests. |
| Star gate insufficient (farms cross-farm stars) | Added the engagement-farm gate; live re-probe dropped a farm's admitted count 20 → 0. |
| Saturated/dead bounties waste time | Discovered in this deep-dive; documented and specced the viability signal. |
| Single-platform dependency (Opire was 502) | Multi-marker discovery (Algora + Polar + native label); never rely on one board. |
| GitHub Search API silently returns 0 | Run bounty searches as separate GitHub-valid passes and merge. |
| Fabricating a "win" | Refused. Every amount and attempt count was read from the live UI; no claim submitted, none claimed. |
| Financial-safety boundary (wallet/account creation) | Not done. Payout onboarding is the user's own action. |
06The realistic strategy that actually wins
Public boards on hot orgs are the worst place to start, not the best. The revised plan:
- Reset expectations. A first win is likely $3–$50 and is reputation-building, not income — the price of unlocking the "contributed before" gate.
- Compete on freshness. The winnable bounty is the one posted minutes ago with zero attempts. This motivates GitScout's next feature: a new-bounty monitor that alerts on freshly-funded issues on your stack.
- Build reputation with non-bounty PRs first — one or two small, clean merged PRs before racing for cash.
- Diversify platforms — re-check Opire (less crowded, ~4% fee); consider Polar-funded issues.
- Verify at the issue, every time — amount, not-already-rewarded, attempt count, veteran presence — before writing a line of code.
07The "wallet" question, corrected
A natural request is "set up a wallet so I can receive the bounty." Two corrections. First, the realistic Algora/Opire path needs no crypto wallet at all — payouts are USD via Stripe Connect, 2–5 days post-reward. A crypto wallet only enters via the bounty-plaza scam we filter out, or optional crypto-native platforms (Gitcoin/Immunefi). Second, account and payout-instrument creation is the user's own action — the concrete step is Stripe Connect payout onboarding under an existing GitHub-linked Algora account. That is the entire "wallet" for this path.
The full engineering story runs across a three-part white-paper series: ideation & research, architecture, data model & security, and the end-to-end bounty lifecycle. The live app is at oss-intelligence-platform.vercel.app.