Full bug bounty cycle: recon, hunting, reporting

★ 8.2 · security

bug-bounty walks Claude Code through the complete bug bounty pipeline — Recon → Learn → Hunt → Validate → Report — in a single, opinionated workflow. The orchestrator `python3 tools/hunt.py` coordinates a catalogue of ~50 tools, handling auth-aware hunting via cookie, bearer token, or auth-file so IDOR, BOLA, and privilege-escalation bugs behind logins are not missed. Vulnerability coverage spans 20+ classes — IDOR, SSRF, XSS, SQLi, race conditions, HTTP request smuggling, cache poisoning, OAuth/OIDC chains, SSTI, subdomain takeover, cloud misconfiguration, and LLM/AI security (ASI01–ASI10 taxonomy, prompt injection, ASCII smuggling, system prompt extraction). A-to-B chaining tables, language-specific grep patterns (JS prototype pollution, Python pickle, PHP type juggling, and more), and bypass tables for SSRF, open redirect, and file upload are built in. Reporting is structured around a 7-Question Gate, four validation gates, CVSS 3.1 scoring, and per-vulnerability-class templates with PoC generation — designed for security researchers running active HackerOne or Bugcrowd programs.