BOUNTYHARNESS / EXECUTION + EVIDENCE
Execution and
evidence for
security research.
BountyHarness is an execution and evidence system for authorized AI-assisted security research. It initializes scope, dispatches registered workflows, enforces safety tiers, preserves run traces, verifies impact, and leaves a reportable evidence set on disk.
MIT licensed / local-only evidence / macOS + Linux
example.comscope.txt.bb/context.envreconhosts / routes / assetsdomain-modelarchetype / surfacesplannerranked techniquesskill.yamlscripts / runbooksimpact-verifiercandidate / proofreportingmanifest / exporttools/registry/*.yaml99 registered tools / capability mapped4 safety tiersscope gate / rate limit / circuit breaker.bb/traces/runs.jsonltiming / exit code / artifacts$OUTDIR/evidence/LOCAL ONLYcurl -fsSL https://raw.githubusercontent.com/Mr-Neutr0n/bounty-harness/main/install.sh | sh -s --Every transition has a file, a gate, or a trace.
The shell stays small. Context initialization, workflow dispatch, registry checks, safety enforcement, and trace capture are explicit. The security logic lives in the skill packages.
Context and scope
Initialize a target, program, scope file, output directory, rate limit, and user agent before a workflow runs.
bb-init / bb-validateWorkflow selection
Run a named workflow from a skill's `skill.yaml`, or let the campaign runner move from recon to plan to execution.
bb-run / bb-huntGovernance and trace
Safety tiers, scope gates, rate limits, and the circuit breaker constrain execution. Every run records timing, tier, tools, and exit code.
bb-tools / .bb/tracesImpact and evidence
Candidate output is not a finding. Verification and reporting assemble reproducible artifacts under the current output directory.
impact-verifier / reportingThe useful unit is the run, not the prompt.
Commands remain ordinary shell commands. The surrounding context, workflow definition, trace, and evidence paths make the work reviewable by another researcher.
$ bb-init example.com --program example --scope-file scope.txt writes .bb/context.env writes .bb/context.json $ bb-run recon passive-subdomains $ bb-run domain-model profile $ bb-run planner generate-plan-safe $ bb-run reporting batch-generate reads candidate results and evidence writes report and evidence manifest
- REQUEST
evidence/<finding>/request.txt- RESPONSE
evidence/<finding>/response.txt- PROOF
evidence/<finding>/poc.sh- VISUAL
evidence/<finding>/screenshot.png- MANIFEST
- timestamp and tool versions
The repository treats scanner output as a candidate. Impact verification and false-positive review happen before reporting.
Safety is part of the execution path.
Workflows declare risk. The harness checks scope and applies the highest required tier instead of treating every command as equivalent.
Scope gate. Without a non-empty scope file, an intrusive campaign is automatically capped to `active-safe`.
Circuit breaker. Consecutive workflow failures put a target into cooldown until the breaker is reset.
Trace. Run records stay under `.bb/traces/`; target data and evidence paths are local and gitignored.
Skills are inspectable packages.
Each package carries its router, executable workflow registry, scripts, runbooks, payloads, evidence rules, and standards context. The harness dispatches; the package contains the method.
Browse the 46 packagesrecon / domain-model / technique-kb / planner / coverage / asset-graph / traffic-corpus / campaign
xss / sqli / ssrf / rce / file-upload / cors-csrf / race-condition / http-protocol / nuclei-scanner
auth / api / persona / cross-account / business-logic / impact-verifier / scope-manager
cicd-security / graphql-audit / web3-audit / meme-coin-audit / identity-domain / binary-analysis
osint / vuln-intel / standard-catalog / reporting / program-memory / triage-validation / enrichment
Inspect the workflow. Run what fits the scope.
MIT licensed. macOS and Linux. No account and no telemetry. Use BountyHarness only on systems you own or are explicitly authorized to test.