ywh2bt

ywh2bt synchronizes your vulnerability reports from the Yes We Hack platform with issues of your bug tracker(s). It automatically retrieves reports you want to copy in your bug tracker, creates the related issue, and syncs further updates between issues and reports.
It comes with a handy GUI to set up and test the integration, while completely controlling the information you allow to be synchronized from both side.

Screenshot of GUI with loaded example file

User Guide
Architecture
Requirements
Installation
Supported trackers
Changelog
Local development

User Guide

A User Guide is available in PDF and HTML formats.

Architecture

YWH2BT embeds both the GUI to set up the integration, and the application to be scheduled on your server to periodically poll and synchronize new reports.
You can either run both on a single machine, or prepare the configuration file on a computer (with the GUI) and transfer it on the server and use it through a scheduled command.

Since data is pulled from YWH platform to your server, only regular outbound web connections need to be authorized on your server.

Requirements

python >=3.8,<=3.13
pip

Supported trackers

github
gitlab
jira / jiracloud
servicenow

Changelog

v2.18:
- fix pagination when ywh2bt fetch issue on gitlab
v2.17:
- fix Jira options with pdf attachment
v2.16:
- report pdf attachment for Jira issue
v2.15:
- automatic management of program slugs
- link to reports from the same program
- display warning message for KEY trackers
- fix Gitlab version parsing error
v2.14:
- fix report and comment images not displayed correctly in tracked issue on git.clacos.ninja
v2.13:
- fix GET YesWeHack API calls method have a body
v2.12:
- added support for new triage workflow
v2.11:
- added support for new impact and cve fields
v2.10:
- added support for new ask for fix process
- added support for report transfer log
v2.9:
- prevented issue synchronization to fail when tracker file upload is unsuccessful
v2.8:
- improved Python versions support (>=3.8 to <=3.12)
- removed the GUI from the default installation (use pip install 'ywh2bt[gui]' to include the GUI)
- fixed an issue with github when the title of an issue is longer than 255 characters
- fixed an issue with jira image previews when multiple attached images have the same name
- fixed an issue when a report/comment has no attachments and the description contains an invalid URL
v2.7:
- added synchronization of "fix verification" logs when "Upload status updates" is checked
- fixed an issue with jira when scope contains special markdown characters
- fixed an issue when "Download bug trackers comments" feedback option is activated and bug tracker attachments do not meet platform attachments requirements (unacceptable mime-type, maximum allowed size exceeded)
- fixed an issue with jira when the title of an issue is longer than 255 characters
v2.6:
- added work around bug trackers maximum size allowed for the text of the issues/comments (content put in Markdown file attachment when necessary)
v2.5:
- added Personal Access Token (PAT) authentication
- removed OAuth authentication
v2.4:
- added option to prevent recreation of issues that were created by a previous synchronization but are not found into the bug tracker anymore
v2.3:
- added support for ServiceNow
v2.2:
- added GitLab option for confidential issues
v2.1:
- added feedback feature (synchronize from bug tracker to report)
- added docker image yeswehack/ywh2bugtracker
- added User Guide PDF and HTML
v0.* to v2.0.0:
- behavior changes:
  - reports logs can selectively be synchronized with the trackers:
    - public comments
    - private comments
    - report details changes
    - report status changes
    - rewards
  - a program can now only be synchronized with 1 tracker
- added support for JSON configuration files
- removed ywh-bugtracker command (use ywh2bt synchronize)
- added ywh2bt command:
  - added ywh2bt synchronize:
    - note: ywh2bt synchronize --config-file FILE --config-format FORMAT is the equivalent of ywh-bugtracker -n -f FILE in v0.*
  - added ywh2bt validate
  - added ywh2bt test
  - added ywh2bt convert
  - added ywh2bt schema
- removed command line interactive mode
- added GUI via ywh2bt-gui command

Local development

Requirements

poetry (pip install poetry)

Installation

make install (or poetry install): creates a virtualenv and install dependencies
make install-with-gui (or poetry install --extras=gui): creates a virtualenv and install dependencies, including the gui

Usage

Instead of ywh2bt [command], run commands using poetry run ywh2bt [command].

Same goes for ywh2bt-gui, run poetry run ywh2bt-gui instead.

Updating User Guide

PDF and HTML versions of the User Guide are generated via Pandoc using docs/User-Guide.md as an input file.
Any changes made to docs/User-Guide.md must be followed by the execution of the command make user-guide in order to regenerate the PDF and HTML files, otherwise the CI will fail.

Metadata

Release files for ywh2bt 2.18.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for ywh2bt 2.18.0
File	Size	Uploaded
ywh2bt-2.18.0.tar.gz	238.2 kB	Aug 26, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for ywh2bt 2.18.0
File	Interpreter	ABI	Platform	Reset
ywh2bt-2.18.0-py3-none-any.whl 303.1 kB Aug 26, 2026	Python 3	none	any	Details

Total release size: 541.3 kB

Release files / ywh2bt-2.18.0.tar.gz

Download URL	ywh2bt-2.18.0.tar.gz
Size	238.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`7d46363b3825eb5ac40e3ef7de32bb5419a05bce64c9729076ecd3cdf342eeb7`
BLAKE2b-256 checksum How to use checksums	`bb1cdfdda59f3f002a5f272aec0fb5af4cf3a4b38cc5676b1a3ff2566b9a15c0`
Upload date	Aug 26, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/2.2.1 CPython/3.11.16 Linux/6.1.0-52-cloud-amd64`

Release files / ywh2bt-2.18.0-py3-none-any.whl

Download URL	ywh2bt-2.18.0-py3-none-any.whl
Size	303.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`7ae4a266d9062a15f0097fedb342deaab05310e092a552ff7cb342f577e5be06`
BLAKE2b-256 checksum How to use checksums	`d325e0acda5b8b5e9476a7ed27d3a10cdeeb33ae6f5c6addc129c6473583a4fc`
Upload date	Aug 26, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`poetry/2.2.1 CPython/3.11.16 Linux/6.1.0-52-cloud-amd64`