v2.0.0 — Production-Ready MVP

BountyBot v2.0.0

First release. Automated bug bounty triage and payout authorization agent powered by the Open Wallet Standard (OWS).

Live demo: https://owsbountybot.shelmail.xyz

Core Features

• Evaluator — Quality scoring (0–10) with confidence, vuln class extraction, affected asset detection, manual review path
• Duplicate detection — Layered fingerprinting (title, description, vuln type, asset, combined) + fuzzy title matching with trigram similarity
• Policy engine — Per-severity caps, daily budget, per-reporter limits, chain allowlists, cooldowns
• Multi-step review — Auto-approve (low value), manual review (medium), admin review (high)
• Payout authorization — OWS-signed approvals with nonce, expiry, and transaction lifecycle states
• Audit logging — Append-only log with correlation IDs, filterable by entity type/id
• SQLite persistence — WAL mode, 7 tables with proper schema and indexes

Security

• Admin token required for manual review, reset, and program re-creation
• CORS, CSP, rate limiting (5/min per IP), SSE connection cap (200)
• Constant-time token comparison, signature redaction from all API responses
• Input validation via Zod, wallet address format validation per chain
• Policy re-check before signing on manual approval
• COALESCE-safe SQL to prevent NULL data loss

Dashboard

• Real-time SSE feed with status filters (All / Signed / Pending / Rejected / Duplicates)
• Silent smart-diff background sync (only updates changed items)
• 16 randomized demo reports across 3 quality tiers
• One-click reset, live connection indicator
• Confidence scores, vuln class tags, duplicate flags

API Endpoints

Endpoint	Method	Description
/api/bounty/create	POST	Initialize bounty program
/api/bounty	GET	Program stats
/api/report/submit	POST	Submit a bug report
/api/report/:id	GET	Report detail + audit trail
/api/report/:id/review	POST	Manual approve/reject (admin)
/api/reports	GET	List with ?status= and ?duplicates=1 filters
/api/reset	POST	Clear all data (admin)
/api/wallet	GET	Treasury wallet address
/api/transactions	GET	Payout history
/api/policy	GET	Active policy + daily budget
/api/audit	GET	Audit log with filters
/api/events	GET	SSE real-time stream

Tech Stack

• Node.js 24+ / Express 5 / ESM
• SQLite (better-sqlite3, WAL mode)
• Zod validation
• @open-wallet-standard/core (OWS SDK)
• Vanilla HTML/CSS/JS frontend (no build step)
• 18 integration tests

Contributors

• @dieutx
• @LoveMath95
• @binhnt92

Built for the OWS Hackathon 2026 — Track 2: Agent Spend Governance & Identity.