security-bounty-hunter

name	security-bounty-hunter
description	Hunt for exploitable, bounty-worthy security issues by biasing toward remotely reachable, user-controlled attack paths over noisy local-only findings. USE WHEN scanning a repo for real vulnerabilities, preparing a Huntr or HackerOne submission, or triaging whether a finding actually qualifies for a bounty.
version	1.0.0
cluster	security

Security Bounty Hunter

Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.

When to Use

• Scanning a repository for exploitable vulnerabilities
• Preparing a Huntr, HackerOne, or similar bounty submission
• Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"

How It Works

Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.

In-Scope Patterns

These are the kinds of issues that consistently matter:

Pattern	CWE	Typical impact
SSRF through user-controlled URLs	CWE-918	internal network access, cloud metadata theft
Auth bypass in middleware or API guards	CWE-287	unauthorized account or data access