For the work between a hunch and a finding.
Follow the lead.
Keep the proof.
Run security research with explicit scope, repeatable workflows, and evidence you can hand to another human.
Explore a runscope.txtskill.yamlimpact-verifierrequest.txt + poc.sh01 / INSIDE A RUN
The steps are visible.
So is what they leave behind.
A walkthrough of the documented workflow.
Illustrative output. No live target requests.
$ bb-init example.com --program example --scope-file scope.txt $ bb-validate
01 Read the target and scope file.
02 Set the output directory and rate limit.
03 Validate the context before execution.
02 / THE TOOLKIT
Small core.
Deep skill library.
The harness handles context, dispatch, and traces. Each skill supplies its own workflows, scripts, and research method.
Recon & planning
Map assets, model the application, and choose what to test.
02Web & identity
Follow requests across inputs, accounts, APIs, and business logic.
03Specialist research
Inspect CI/CD, GraphQL, native binaries, and smart contracts.
04Verification & reporting
Review candidates, reproduce impact, and package the evidence.
03 / EXPLICIT BOUNDARIES
Give the run
a scope.
Use BountyHarness on systems you own or are authorized to test. Workflows declare risk; scope gates, rate limits, and a circuit breaker constrain execution.
Understand the safety modelRead-only discovery or local analysis.
Rate-limited target interaction.
Requires a non-empty scope file.
Requires human approval.
04 / START LOCAL
Your next investigation
starts here.
Install the open-source toolkit.
Keep the traces and evidence on your machine.
curl -fsSL https://raw.githubusercontent.com/Mr-Neutr0n/bounty-harness/main/install.sh | sh -s --