Deployment and operation

Deploy behind TLS or a tunnel, manage logs and shut down cleanly.

Remote access

Bind to the interface reachable by your client. 127.0.0.1 accepts only local connections; 0.0.0.0 listens on all IPv4 interfaces. Use a host interface address rather than an arbitrary public IP not assigned to the machine.

The license header is a shared credential and ordinary HTTP does not encrypt it. For remote use, choose an encrypted tunnel or TLS listener/proxy with access appropriate to your assessment. This also protects captured request and finding data.

TLS

The server supports a certificate/key pair through environment configuration:

export BURPBOUNTY_SERVER_CERTFILE="/etc/burpbounty-server/tls/server.crt"
export BURPBOUNTY_SERVER_KEYFILE="/etc/burpbounty-server/tls/server.key"
./burpbounty-server-linux-amd64 --ip 0.0.0.0 --port 8443 --mcp \
  --profiles-dir "/opt/burpbounty/BurpBountyData/profiles" \
  --history-dir "/var/lib/burpbounty-server/history"

Both files are required to enable TLS. Configure clients with https:// and a certificate they trust. For a reverse proxy, preserve X-BURPBOUNTY-LICENSE, MCP session/protocol headers and POST/GET/DELETE methods; accommodate streaming responses and body size limits.

Example systemd service

Adapt paths, the account, target policy and budgets to the deployment. Create a readable environment file containing BURPBOUNTY_LICENSE_KEY through your secret-management process.

[Unit]
Description=Burp Bounty Server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=burpbounty
Group=burpbounty
WorkingDirectory=/opt/burpbounty
EnvironmentFile=/etc/burpbounty-server.env
ExecStart=/opt/burpbounty/burpbounty-server-linux-amd64 --ip 127.0.0.1 --port 8081 --mcp --profiles-dir /opt/burpbounty/BurpBountyData/profiles --history-dir /var/lib/burpbounty-server/history
Restart=on-failure
TimeoutStopSec=90
UMask=0077

[Install]
WantedBy=multi-user.target

Create the account and writable history directory before starting. The example binds to loopback for access through a local proxy/tunnel and leaves MCP approvals enabled for every target. Restarting the service cancels current work; schedule restarts with scan ownership in mind.

Logs and metrics

Use --debug while diagnosing authentication, scan creation or MCP problems. It exposes more request/configuration detail, including potentially sensitive profile tokens; retain diagnostic output deliberately.

--scan-logs-save preserves temporary scan logs on shutdown, outside the persistent-finding quota. These can grow independently of history.

Prometheus metrics are served at http://127.0.0.1:8082/metrics by default. The monitoring listener is separate from REST/MCP and does not use the license middleware. For two instances on one host, assign different BURPBOUNTY_MONITORING_PORT values, distinct main ports and distinct history directories.

Shutdown

Ctrl+C or service termination starts graceful cancellation, including long-lived MCP connections. The default HTTP shutdown timeout is one minute. A second Ctrl+C restores forced termination behavior. Prefer graceful shutdown so retained findings can finish writing; no mode persists an executable scan queue for restart.