security-bounty-hunter

Topics in the source

• Security Bounty Hunter
• When to Use
• How It Works
• In-Scope Patterns
• Skip These
• Workflow
• Example Triage Loop
• Report Structure

Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review. Scanning a repository for exploitable vulnerabilities Preparing a Huntr, HackerOne, or similar bounty submission Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?" Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope. These are the kinds of issues that consistently matter: | Pattern | CWE | Typical impact | | --- | --- | --- | | SSRF through user-controlled URLs | CWE-918 | internal network access, cloud metadata theft | | Auth bypass in middleware or API guards | CWE-287 | unauthorized account or data access | | Remote deserialization or upload-to-RCE paths | CWE-502 | code execution | | SQL injection in reachable endpoints | CWE-89 | data exfiltration, auth bypass, data destruction | | Command injection in request handlers | CWE-78 | code execution | | Path traversal in file-serving paths | CWE-22 | arbitrary file read or write | | Auto-triggered XSS | CWE-79 | session theft, admin compromise | The

This is an excerpt. Refer to the complete source and its current requirements.