Security Bounty Hunter

Finds exploitable, bounty-worthy security vulnerabilities in a repository, focusing on remotely reachable issues.

What it does

Guides a vulnerability hunt through a codebase, prioritizing remotely reachable and user-controlled attack paths such as SSRF, authentication bypass, deserialization or upload to RCE, SQL injection, command injection, path traversal and auto-triggered XSS. It lists low-signal patterns to skip, such as local-only deserialization, CLI-only eval, missing security headers and self-XSS. It produces a triage pass over static tool output and a structured report with description, vulnerable code, proof of concept, impact and affected versions.

When to use it

Use it when the goal is real vulnerability discovery for responsible disclosure or a bug bounty submission rather than a broad security practice review. It fits scanning a repository for exploitable issues and preparing submissions for platforms such as Huntr or HackerOne. It also helps decide whether a finding is genuinely bounty-worthy instead of only theoretically insecure. It is not meant for general code review or for issues outside the target program's scope.

Requirements

No scripts are shipped; it is instructions only. It references optional static analysis tooling such as semgrep as triage input, and assumes access to the target repository and its scope or disclosure policy documents.