> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-server/operations.md).

# Deployment and operation

Deploy behind TLS or a tunnel, update the service, manage logs and shut down cleanly.

## Remote access

Bind to the interface reachable by your client. `127.0.0.1` accepts only local connections; `0.0.0.0` listens on all IPv4 interfaces. Use a host interface address rather than an arbitrary public IP not assigned to the machine.

The license header is a shared credential and ordinary HTTP does not encrypt it. For remote use, choose an encrypted tunnel or TLS listener/proxy with access appropriate to your assessment. This also protects captured request and finding data.

## TLS

The server supports a certificate/key pair through environment configuration:

```bash
export BURPBOUNTY_SERVER_CERTFILE="/etc/burpbounty-server/tls/server.crt"
export BURPBOUNTY_SERVER_KEYFILE="/etc/burpbounty-server/tls/server.key"
./burpbounty-server-linux-amd64 --ip 0.0.0.0 --port 8443 --mcp \
  --profiles-dir "/opt/burpbounty/BurpBountyData/profiles" \
  --history-dir "/var/lib/burpbounty-server/history"
```

Both files are required to enable TLS. Configure clients with `https://` and a certificate they trust. For a reverse proxy, preserve `X-BURPBOUNTY-LICENSE`, MCP session/protocol headers and POST/GET/DELETE methods; accommodate streaming responses and body size limits.

## Example systemd service

Adapt paths, the account, target policy and budgets to the deployment. Create a readable environment file containing `BURPBOUNTY_LICENSE_KEY` through your secret-management process.

```ini
[Unit]
Description=Burp Bounty Server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=burpbounty
Group=burpbounty
WorkingDirectory=/opt/burpbounty
EnvironmentFile=/etc/burpbounty-server.env
ExecStart=/opt/burpbounty/burpbounty-server-linux-amd64 --ip 127.0.0.1 --port 8081 --mcp --profiles-dir /opt/burpbounty/BurpBountyData/profiles --history-dir /var/lib/burpbounty-server/history
Restart=on-failure
TimeoutStopSec=90
UMask=0077

[Install]
WantedBy=multi-user.target
```

Create the account and writable history directory before starting. The example binds to loopback for access through a local proxy/tunnel and leaves MCP approvals enabled for every target. Restarting the service cancels current work; schedule restarts with scan ownership in mind.

## Updates

Server checks for compatible executable updates at startup, but installs them only when you explicitly run `--update`. An available-version notice is shown with `--debug`; no available update or compatible release is silent. There is no automatic installation or service restart.

Stop the service and run the appropriate command using your executable's actual path and platform name:

| Task                                | Example command on Linux x86-64                                                                            |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Update the executable               | `./burpbounty-server-linux-amd64 --update`                                                                 |
| Install or update official profiles | `./burpbounty-server-linux-amd64 --update-profiles --profiles-dir /opt/burpbounty/BurpBountyData/profiles` |

Both commands require `BURPBOUNTY_LICENSE_KEY` in their process environment and exit after completing the update. Run them separately. Stop every server using a catalogue before updating that catalogue, then restart the affected services yourself. An executable update does not update profiles, and a profile update does not update the executable.

The updater retains rollback copies and preserves custom profile files. Changes to official profile files can block an update so they are not silently overwritten. See [update prerequisites, migration and rollback](/burp-bounty-server/installation.md#stop-and-update) for write permissions, conflicts and backup handling.

## Logs and metrics

Use `--debug` while diagnosing authentication, scan creation or MCP problems. It exposes more request/configuration detail, including potentially sensitive profile tokens; retain diagnostic output deliberately.

`--scan-logs-save` preserves temporary scan logs on shutdown, outside the persistent-finding quota. These can grow independently of history.

Prometheus metrics are served at `http://127.0.0.1:8082/metrics` by default. The monitoring listener is separate from REST/MCP and does not use the license middleware. When running multiple instances on one host, assign different `BURPBOUNTY_MONITORING_PORT` values, distinct main ports and distinct history directories.

## Shutdown

Ctrl+C or service termination starts graceful cancellation, including long-lived MCP connections. The default HTTP shutdown timeout is one minute. A second Ctrl+C restores forced termination behavior. Prefer graceful shutdown so retained findings can finish writing; no mode persists an executable scan queue for restart.