Operational
questions.
Is this a scanner? ›
No. BountyHarness orchestrates scanners and manual workflows into evidence-backed findings. Scanner output is a candidate. The harness turns it into a report with request, response, PoC, and impact proof.
Do I need to pay for anything? ›
No. MIT licensed, fully open source. External tools (nuclei, subfinder, etc.) are free. Bring your own API keys for LLM features.
Will this get me banned from a program? ›
Not if you use scope files and respect safety tiers. Intrusive workflows auto-cap to active-safe without a scope file. The harness will warn you before you do something risky. But you are responsible for staying in scope.
Does it phone home or collect telemetry? ›
No. Zero telemetry. All evidence stays local. The only network calls are the ones you explicitly run against your target or when installing tools via bb-tools.
Can I use this without an AI agent? ›
Yes. Every workflow is a plain shell command in skill.yaml. Run bb-run recon passive-subdomains manually. The agent just automates dispatch and triage.
How is this different from just running nuclei? ›
Nuclei is one skill (nuclei-scanner) inside the harness. BountyHarness adds planning, asset graphs, program memory, impact verification, and reporting, while wrapping nuclei with scope awareness and result validation.
What about false positives? ›
The impact-verifier skill gates findings before reporting. The triage-validation skill runs a 7-question gate. The harness is designed to produce fewer, better reports, not more noise.
Can I add my own skill? ›
Yes. Create .claude/skills/my-skill/ with SKILL.md, skill.yaml, scripts/, runbooks/, and payloads/. See skill-scientist for the design workflow.
Where does evidence go? ›
Under $OUTDIR/evidence/ and evidence/<finding>/, all gitignored. Nothing is committed. Run gitleaks detect --source . --no-git -v before sharing anything.