| name | security-bounty-hunter |
| description | Hunt for exploitable, bounty-worthy security issues by biasing toward remotely reachable, user-controlled attack paths over noisy local-only findings. USE WHEN scanning a repo for real vulnerabilities, preparing a Huntr or HackerOne submission, or triaging whether a finding actually qualifies for a bounty. |
| version | 1.0.0 |
| cluster | security |
Security Bounty Hunter
Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.
When to Use
- Scanning a repository for exploitable vulnerabilities
- Preparing a Huntr, HackerOne, or similar bounty submission
- Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"
How It Works
Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.
In-Scope Patterns
These are the kinds of issues that consistently matter:
| Pattern | CWE | Typical impact |
|---|
| SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft |
| Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access |
