Claude Bug Bounty

Find security vulnerabilities, get paid — with AI doing the heavy lifting

Your AI hunting partner that remembers past targets, spots vulnerabilities, and writes reports for you.
The community made a meme coin to support the project CA: J6VzBAGnyyNEyzyHhauwg3ofRctFxnTLzQCcjUdGpump _{by shuvonsec}

What Is This?  |  Quick Start  |  Commands  |  What's New  |  Install  |  FAQ  |  Terms

  14 commands  ·  8 AI agents  ·  9 skill domains
  20 web2 vuln classes  ·  10 web3 bug classes
  Burp MCP  ·  HackerOne MCP  ·  Autonomous Mode

Bug bounty hunting is when companies pay you real money to find security vulnerabilities in their websites and apps before bad actors do. Platforms like HackerOne and Bugcrowd connect hunters with companies. Payouts range from $100 to $1,000,000+ depending on severity.

This tool is a plugin for Claude Code (Anthropic's AI coding assistant) that turns it into a professional bug bounty hunting partner. Instead of juggling 15 different tools and writing reports from scratch, you just type a command and the AI handles the rest.

In plain terms:

• You give it a target website
• It automatically scans the site, finds vulnerabilities, validates they're real, and writes a professional report
• It remembers what you found on past targets and applies that knowledge to new ones
• You can even put it on autopilot and let it hunt on its own while you sleep

Who is it for?

• Security researchers who want to move faster
• Bug bounty hunters who are tired of the manual grind
• People learning security who want AI guidance at every step

Most hunters waste hours on things that shouldn't take that long:

• Manually running 10+ tools in the right order just to map a target
• Writing the same report structure from scratch every single time (45 min each)
• Forgetting that a technique worked on a similar target 3 months ago
• Submitting bugs that get rejected because they weren't properly validated first
• Jumping between terminal windows, browser, notes, and report drafts

Prerequisite: You need Claude Code installed. It's Anthropic's free AI coding tool that runs in your terminal.

Step 1 — Install tools + skills

git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh   # installs scanning tools (subfinder, httpx, nuclei...)
chmod +x install.sh && ./install.sh               # installs AI skills + commands into Claude Code

Step 2 — Start hunting

claude                          # open Claude Code in your terminal

/recon target.com               # step 1: map the target (subdomains, live pages, URLs)
/hunt target.com                # step 2: test for vulnerabilities
/validate                       # step 3: make sure the finding is real before writing it up
/report                         # step 4: generate a professional submission report

That's the core loop. Four commands, full workflow.

Step 3 — Go autonomous

/autopilot target.com --normal  # AI does the whole thing, pauses for your review at the end
/pickup target.com              # continue where you left off on a previous target
/intel target.com               # get CVEs + disclosed reports relevant to this target

Don't use Claude Code? Run the Python tools directly:

python3 tools/hunt.py --target target.com
./tools/recon_engine.sh target.com

Think of it like a team of specialists, each doing one job:

                        YOU
                         |
                   ┌─────▼─────┐
                   │   Claude   │ ◄── Burp MCP (sees your browser traffic)
                   │   Code     │ ◄── HackerOne MCP (program intel)
                   └─────┬─────┘
                         |
         ┌───────────────┼───────────────┐
         |               |               |
   ┌─────▼─────┐  ┌──────▼──────┐  ┌────▼────┐
   │   Recon    │  │    Hunt     │  │ Report  │
   │  (map it)  │  │  (test it)  │  │(write it│
   └─────┬─────┘  └──────┬──────┘  └────┬────┘
         |               |               |
   finds all         checks for      formats for
   subdomains,       vulnerabilities  HackerOne /
   URLs, APIs        & validates      Bugcrowd /
                     findings         Immunefi
         |               |               |
   ┌─────▼───────────────▼───────────────▼─────┐
   │              Hunt Memory                   │
   │   remembers everything across sessions     │
   └────────────────────────────────────────────┘

Each step feeds the next. Claude orchestrates all of it, or you run any step on its own.

8 specialized agents, each built for one job:

• Auto-memory at session end — the AI now automatically logs what it tested and found after every hunt session. Memory used to stay empty until you manually ran /remember. Now the flywheel starts on day 1.
• README badge and stats updated, install_tools.sh added to Quick Start (was missing)
• hunt-memory/ added to .gitignore (contains full URL history, shouldn't be committed)

• /token-scan <contract> — automated rug pull scanner for EVM and Solana tokens
• skills/meme-coin-audit/ — 8 token bug classes: mint authority, freeze authority, LP locks, honeypot detection, bonding curve exploits, Solana SPL checks
• New agent: token-auditor

• GitHub Actions security scanning built into the recon pipeline
• Auto-detects GitHub orgs from recon data and scans their workflow files
• 52 rules, 81.6% GHSA coverage — catches expression injection, secret leaks, supply chain attacks

# macOS
brew install go python3 node jq

# Linux (Ubuntu/Debian)
sudo apt install golang python3 nodejs jq

You also need Claude Code installed and a free account.

git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
chmod +x install_tools.sh && ./install_tools.sh   # scanning tools (subfinder, httpx, nuclei, etc.)
chmod +x install.sh && ./install.sh               # AI skills + commands into Claude Code

export CHAOS_API_KEY="your-key-here"
echo 'export CHAOS_API_KEY="your-key-here"' >> ~/.zshrc

These apply every session, no exceptions:

 1. READ FULL SCOPE FIRST   — only test what the program says you can
 2. ONLY REAL BUGS          — "Can an attacker do this RIGHT NOW?" if no, stop
 3. KILL WEAK FINDINGS FAST — 30-second check saves hours of wasted reporting
 4. NEVER GO OUT OF SCOPE   — one wrong request can get you banned
 5. 5-MINUTE RULE           — no progress after 5 min? move to the next target
 6. VALIDATE BEFORE REPORT  — run /validate before you spend 30 min writing
 7. IMPACT FIRST            — start with the bugs that have the worst consequences

PRs welcome. Best contributions:

• New vulnerability scanners or detection modules
• Payload additions to skills/security-arsenal/SKILL.md
• Real-world methodology improvements (with evidence from paid reports)
• Support for more platforms (YesWeHack, Synack, HackenProof)

git checkout -b feature/your-contribution
git commit -m "Add: short description"
git push origin feature/your-contribution