v6.0.0 — Provider Freedom

BugHunter v6.0.0 gives you the freedom to run on whatever AI you want — free, local, or cloud — and adds a sponsor-ready polish across the board.

Highlights

🔌 More providers, more freedom

• OpenRouter provider — set OPENROUTER_API_KEY, pick option 7 in bughunter setup, or BRAIN_PROVIDER=openrouter. OpenAI-compatible gateway with a short curated model list.
• OrcaRouter provider — set ORCAROUTER_API_KEY, pick option 8 in bughunter setup, or BRAIN_PROVIDER=orcarouter. OpenAI-compatible gateway with a short curated model list.
• Smarter Ollama model selection — bughunter setup lists your installed local models and remembers the provider/model pair. Non-interactive: bughunter setup --provider ollama --model <name>. One-off overrides via --model / BRAIN_MODEL, with no silent fallback to a different model.
• SDK-free Ollama fallback — setup and chat use Ollama's local HTTP API when the Python package isn't installed, and report install failures instead of swallowing them.

📦 Cleaner install / uninstall

• Rerunning install.sh --agent standalone refreshes the active managed bughunter path instead of letting an old system install shadow a newer one.
• Expanded uninstall.sh — covers standalone and every supported agent, preserves config by default, with --purge-config to wipe it.

💜 Sponsor-ready polish

• README now leads with an Open for Sponsorship callout and a Powered by AwareXone.com credit (hero badge + footer).
• Same credit on the project site footer, plus a .github/FUNDING.yml so the repo shows a Sponsor button.

---

_{Powered by AwareXone.com — Your AI Agent Against Scams & Fraud}

Full changelog: https://github.com/shuvonsec/claude-bug-bounty/blob/main/CHANGELOG.md

v5.0.0 — False Positive Reduction + Repository Polish

False Positive Reduction

The biggest complaint from the community was that almost every result came back N/A. This release fixes that at every layer.

Root Cause

The scanner was logging every hit as a finding without requiring proof of impact. Dalfox alert(1) was logged as XSS. Nuclei version-detection templates were logged as vulnerabilities. IDOR on your own data was logged as IDOR. None of these should have made it past the scanner.

4-Layer Fix

Layer 1 — Scanner Confidence States

Every finding is now tagged before it leaves the scanner:

State	Meaning
[CONFIRMED]	PoC-verified, real impact demonstrated
[POSSIBLE]	Strong signal, needs manual verification
[INFORMATIONAL]	Version/banner/config data — not a vulnerability

Examples of what changed:

• Dalfox alert(1) → [POSSIBLE] (not [CONFIRMED] — CSP may block execution)
• Nuclei info template → [INFORMATIONAL] (version detection is not an exploit)
• SQLi time-delay → [POSSIBLE] (delay ≠ data exfil)
• SSRF DNS-only callback → [POSSIBLE] (DNS ping ≠ internal access)

Layer 2 — Validation Gate Hardening

/validate now requires a real curl PoC. Blank answer or typing "skip" = automatic fail. No PoC, no report.

For auth-related findings (IDOR, auth bypass, account takeover, privilege escalation), three identity checks are now enforced:

1. Cross-account tested — did session A read session B's data?
2. Fresh session tested — reproduced from a clean browser state?
3. Anonymous delta — does removing auth change the response?

Blank answers auto-fail. The most common reason "confirmed IDOR" came back N/A was that the hunter only tested their own data.

Layer 3 — Rejection Reason Codes

Every gate failure now returns a specific code so you know exactly why a finding was killed:

Code	Meaning
no_reproducible_impact	No curl PoC provided
no_concrete_impact	Impact is theoretical, not demonstrated
unrealistic_privileges	Requires admin/physical/MFA precondition attacker can't get
identity_not_proven	Cross-account access not verified
not_reproducible	Cannot reproduce from scratch
out_of_scope	Asset not on program scope page
duplicate_or_already_disclosed	Already reported or documented

Layer 4 — Kill Signal Table (SKILL.md)

Added a 12-row "COMMON N/A CLASSES — KILL SIGNALS" table to skills/triage-validation/SKILL.md. Each row has a specific observable signal that tells you to kill the finding before writing the report:

• Reflected XSS with Content-Security-Policy header present → kill
• SSRF DNS-only with no HTTP reply + internal content → kill
• IDOR where user ID in response matches your own test account → kill
• SQLi where you got DB error string but no table rows returned → kill
• CORS wildcard with withCredentials absent → kill
• Nuclei info severity → kill

Regression Tests

14 new tests in tests/test_false_positives.py covering every known N/A class. If a future change accidentally lets a weak finding through, CI breaks.

Classes tested: SSRF DNS-only · Open redirect without token theft · CORS without credentialed exfil · IDOR own-data-only · Auth bypass with admin precondition

---

Repository Polish

README redesign — Rewrote from ~590 lines to ~230 lines. Cleaner structure, tighter tables, collapsible vuln lists, star history embed. No walls of text.

Project Structure section — Annotated directory tree added to README. Every folder captioned inline.

Folder READMEs — 11 new README.md files, one per major directory. Each has a purpose statement and file table:

agents/ · commands/ · tools/ · memory/ · rules/ · scripts/ · hooks/ · site/ · wordlists/ · docs/ · mcp/

---

Stats

• 14 new regression tests — all passing
• 7-Question Gate updated with Q8 identity check
• 26 commands · 9 agents · 10 skills · ~35 tools
• Scanner confidence states on 100% of findings

---

_{Powered by AwareXone.com — Your AI Agent Against Scams & Fraud}

v4.0.0 — Meme Coin Security Module

Meme Coin Security Module

New /token-scan command and full meme coin rug pull detection for EVM and Solana tokens.

New Files (8)

Component	What It Does
skills/meme-coin-audit/SKILL.md	New skill — rug pull detection, token authority checks, bonding curve exploits
tools/token_scanner.py	Automated red flag scanner — hidden mint, honeypot, fee traps, LP drain, fake renounce
agents/token-auditor.md	Fast token audit agent (8-class protocol)
commands/token-scan.md	/token-scan <contract> — instant rug pull analysis
web3/10-meme-coin-bugs.md	8 meme coin bug classes with real exploit examples
web3/11-solana-token-audit.md	Solana-specific: SPL authorities, Token-2022, pump.fun, Raydium, Jupiter, PDA patterns
web3/12-dex-lp-attacks.md	DEX/LP attacks: sandwich, pool sniping, CL position manipulation
tests/test_token_scanner.py	39 tests for the token scanner

8 Bug Classes Covered

1. Hidden Mint / Unlimited Supply — deployer mints post-launch, dumps on LP
2. Honeypot / Transfer Restriction — buy works, sell blocked (blacklists, max tx, approve override)
3. Fee Manipulation — sell fee set to 99% after initial buys
4. Liquidity Pool Drain — LP removal, migration, sync manipulation
5. Bonding Curve Manipulation — pump.fun graduation exploits, virtual reserve inflation
6. Authority Retention (Solana) — retained mint/freeze/update authorities, Token-2022 extensions
7. Fake Renounce / Hidden Ownership — ownership appears renounced but backdoor control retained
8. Sandwich Amplification by Design — zero slippage auto-swaps, rebase on transfer

Solana Coverage

• SPL Token authority checklist (mint, freeze, update, close)
• Token-2022 extension risk matrix (transfer hooks, permanent delegate, transfer fees)
• pump.fun bonding curve analysis (graduation sniping, bundled buys, fee extraction)
• Raydium LP pool vulnerabilities (burn vs lock, skewed ratios)
• Jupiter routing exploits (fake pool injection, price oracle manipulation)
• PDA authority patterns (hidden control via upgradeable programs)
• Anchor program vulnerabilities (missing signer/owner checks, unchecked arithmetic)

Grep Arsenal Expansion

3 new grep blocks added to web3/03-grep-arsenal.md:

• Block 11 — Token Rug Pull Detection (EVM)
• Block 12 — Solana Token Authorities
• Block 13 — DEX / LP Manipulation

Quick Start

# Scan an EVM token contract
python3 tools/token_scanner.py contracts/Token.sol

# Scan a Solana program
python3 tools/token_scanner.py programs/token/ --chain solana --recursive

# Full directory scan with markdown report
python3 tools/token_scanner.py src/ --recursive --output findings/token-report.md

Stats

• 3,832 lines added across 11 files
• 39 new tests, 250 total passing
• 9 skills, 14 commands, 8 agents

---

_{Powered by AwareXone.com — Your AI Agent Against Scams & Fraud}

v3.0.0 — Bionic Hunter: Autonomous Mode + MCP Integrations

Bionic Hunter Release

Transforms Claude Bug Bounty from a knowledge-only tool into a bionic hacker -- AI that sees your traffic, remembers past hunts, fetches real-time intel, and runs autonomous hunt loops.

New Features

Autonomous Hunt Loop (/autopilot)

• 7-step loop: scope, recon, rank, hunt, validate, report, checkpoint
• 3 modes: --paranoid (stop per finding), --normal (batch), --yolo (minimal checkpoints)
• Circuit breaker stops hammering hosts after consecutive failures
• Per-host rate limiting (1 req/sec testing, 10 req/sec recon)
• Every outbound request logged to audit.jsonl

Persistent Hunt Memory

• JSONL-based journal with concurrent-safe writes
• Cross-target pattern learning
• Target profiles with tested/untested endpoints
• Schema-validated data with versioning

MCP Integrations

• Burp Suite -- read proxy history, replay requests, Collaborator payloads
• HackerOne -- public API: disclosed reports, program stats, scope/policy

On-Demand Intel (/intel)

• Wraps learn.py + HackerOne MCP + hunt memory context
• Flags untested CVEs, new endpoints, cross-target patterns

Deterministic Scope Safety

• Anchored suffix matching (not fnmatch, not LLM judgment)

5 New Commands

/autopilot, /surface, /resume, /remember, /intel

2 New Agents

autopilot (autonomous loop), recon-ranker (surface ranking)

Reorganized

All tools in tools/, MCP servers in mcp/, memory in memory/

Stats

• 13 slash commands (was 8)
• 7 agents (was 5)
• 129 tests all passing
• 21 tool files organized in tools/

---

_{Powered by AwareXone.com — Your AI Agent Against Scams & Fraud}

v1.0.0 — Claude Bug Bounty Hunter

Initial Release

AI-assisted bug bounty hunting with Claude Code — point it at any target and Claude maps the attack surface, runs scanners, validates findings, and writes the HackerOne or Bugcrowd report.

What's included

• Full recon pipeline — subdomain enum, DNS resolution, live host detection, URL crawling
• Vulnerability scanners — IDOR, SSRF, XSS, SQLi, OAuth, GraphQL, LLM injection, race conditions
• AI/LLM testing — prompt injection, chatbot IDOR, system prompt extraction
• Web3 support — reentrancy, flash loans, access control, signature replay
• Claude prompts — ready-to-use prompts for every hunting stage
• Report generator — HackerOne and Bugcrowd format output

Works with

Claude Code, Claude.ai, any AI that reads files.

Related

• web3-bounty-ai-skills — Smart contract security knowledge base
• public-skills-builder — Build skill files from public writeups

---

_{Powered by AwareXone.com — Your AI Agent Against Scams & Fraud}