> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/global-variables.md).

# Variables

Keep profiles reusable with context values, custom tokens and interaction IDs.

Profiles can include tokens that are substituted at runtime. Configure Pro's custom values in **Settings → Variables**. When Pro dispatches a REST scan, it sends its custom variables as the scan's `tokens` map.

## Request-derived tokens

| Token                             | Meaning / boundary                                                                                                                                        |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `{CURRENT_URL}`                   | Original request URL.                                                                                                                                     |
| `{CURRENT_PROTOCOL}`              | HTTP or HTTPS service protocol.                                                                                                                           |
| `{CURRENT_HOST}`                  | Original request host.                                                                                                                                    |
| `{CURRENT_PORT}`                  | Service port.                                                                                                                                             |
| `{CURRENT_PATH}`                  | URL path.                                                                                                                                                 |
| `{CURRENT_METHOD}`                | Original HTTP method.                                                                                                                                     |
| `{CURRENT_QUERY}`                 | URL query string, not arbitrary POST body data.                                                                                                           |
| `{CURRENT_FILE}`                  | **Different semantics:** Pro uses the URL file component (path plus query); Server uses the path basename.                                                |
| `{CURRENT_SUBDOMAIN}`             | Pro's hostname-label derivation; not public-suffix-aware and not a Server template token.                                                                 |
| `{CURRENT_USER_AGENT}`            | Original User-Agent value.                                                                                                                                |
| `{CURRENT_REFERER}`               | Referer value when available.                                                                                                                             |
| `{CURRENT_ORIGIN}`                | Origin value when available.                                                                                                                              |
| `{CURRENT_CONTENT_TYPE}`          | Content-Type; normalization can differ between engines.                                                                                                   |
| `{CURRENT_ACCEPT}`                | Accept value.                                                                                                                                             |
| `{CURRENT_ACCEPT_LANGUAGE}`       | Accept-Language value.                                                                                                                                    |
| `{CURRENT_ACCEPT_ENCODING}`       | Accept-Encoding value.                                                                                                                                    |
| `{CURRENT_CONTENT_LENGTH}`        | Original header value, not a calculation of a future payload length.                                                                                      |
| `{CURRENT_COOKIES}`               | Pro cookie-header substitution in supported paths; not a Server template token.                                                                           |
| `{CURRENT_INSERTION_POINT_NAME}`  | Pro's insertion context. Server currently uses the selected entrypoint text for both name/value token variants; do not assume it yields a parameter name. |
| `{CURRENT_INSERTION_POINT_VALUE}` | Insertion context value; verify name-mutation and explicit-selection behavior.                                                                            |
| `{RANDOM}`                        | Generated identifier; do not expect identical values across separate requests/engines.                                                                    |

Header-dependent tokens need the header to exist. Inspect unresolved tokens in the final request rather than assuming a missing value will be synthesized. Server additionally recognizes `{CURRENT_INDEX}` and `{CURRENT_INSERTION_POINT}`; these are not general Pro tokens.

## Callback and email values

`{BC}` is Pro's Collaborator token. Server converts it to `{BH}` and requires a configured blind-host provider to create/poll interactions. A scan can be Finished with a warning or skipped callback-dependent checks.

`{EMAIL}` is shown in Pro's variable reference, but do not assume a configured address exists automatically. Provide a deliberate custom value for workflows that need it. Server's ordinary modifier list does not automatically configure an email provider.

## Pack defaults

| Token                   | Initial Pro value              |
| ----------------------- | ------------------------------ |
| `{OPENREDIR_HOST}`      | `bountysecurity.ai`            |
| `{OPENREDIR_URL}`       | `https://bountysecurity.ai`    |
| `{LINUX_FILE}`          | `etc/passwd`                   |
| `{LINUX_FILE_STRING}`   | `root:x`                       |
| `{WINDOWS_FILE}`        | `windows/win.ini`              |
| `{WINDOWS_FILE_STRING}` | `for 16-bit app support`       |
| `{REDIRECT_DOMAIN}`     | `bountysecurity.ai`            |
| `{ATTACKER_DOMAIN}`     | `yourdomain.com` (placeholder) |
| `{XXE_FILE}`            | `/etc/passwd`                  |
| `{XXE_GREP}`            | `root:x`                       |
| `{XXE_FILE_B64}`        | `ZmlsZTovLy9ldGMvcGFzc3dk`     |
| `{XXE_GREP_B64}`        | `cm9vdD`                       |
| `{XXE_WIN_FILE}`        | `c:/boot.ini`                  |
| `{XXE_WIN_GREP}`        | `boot loader`                  |
| `{XXE_WIN_FILE_B64}`    | `ZmlsZTovLy9jOi9ib290LmluaQ==` |
| `{RCE_FILE}`            | `/etc/passwd`                  |
| `{RCE_COMMAND}`         | `id`                           |

The six legacy tokens (`OPENREDIR_*`, `LINUX_FILE*` and `WINDOWS_FILE*`) are restored once when upgrading, including for previously empty variable lists. Existing values, including deliberately empty ones, are preserved. Subsequent edits and deletions remain saved across reloads. File-path values are substituted literally; the Linux and Windows values above have no leading slash.

Defaults are test inputs, not confirmation that a callback domain or target file is appropriate. Update paired payload/grep variables consistently.

## Server custom values

REST accepts a map in the configuration file:

```json
{"tokens": {"{ATTACKER_DOMAIN}": "callback.example.test", "{RCE_COMMAND}": "id"}}
```

Server MCP has no equivalent per-call map parameter. Use deliberate configured values or supplied profiles rather than inventing an MCP argument. Custom tokens inside regex greps are treated as literal values; they are not a way to inject arbitrary regex syntax.

`$BBOUNTY$` is different: it is a literal marker placed in a Server scan **request** to select a span, not a profile variable or a callback token.