Execution has
explicit boundaries.
Every workflow declares a safety tier. Scope, rate limits, the circuit breaker, and human approval rules are enforced around execution.
Safety Tiers
| Tier | Behavior | Gate |
|---|---|---|
| passive | Read-only discovery or local analysis. No target interaction. | None |
| active-safe | Interacts with target but remains read-only. | None, but rate-limited |
| intrusive | Payloads, fuzzing, WAF-triggering scans. | Requires scope file. Without one, auto-caps to active-safe. |
| destructive-manual | Data modification, privilege changes. | Never automated. Explicit human approval only. |
Intrusive auto-cap: If you run
bb-hunt without --scope-file, the harness caps you to active-safe, even if you asked for intrusive. This is enforced in code.Scope Guardrails
- Scope files (
scope-managerskill) define what's in and out of scope. Every workflow validates scope before intrusive testing. - Circuit breaker kills a target after repeated consecutive failures, prevents hammering a WAF into a ban.
- Rate limits from RunContext or per-workflow defaults. Every workflow respects them.
Evidence Standard
Scanner output is never a finding. A reportable issue needs:
| Artifact | Path |
|---|---|
| Full request with headers | evidence/<finding>/request.txt |
| Full response headers + body | evidence/<finding>/response.txt |
| Screenshot or visual proof | evidence/<finding>/screenshot.png |
| Reproduction script | evidence/<finding>/poc.sh |
| Tool versions + timestamp | evidence manifest |
Local-only. Evidence is gitignored. Nothing leaves your machine unless you submit the report. Run
gitleaks detect --source . --no-git -v before committing anything that touched target data.What This Is Not
Not a license to test random systems. BountyHarness is an orchestration framework for authorized research. Many workflows produce candidates that require human judgement, reproduction, and impact proof. Use it only on systems you own or are explicitly authorized to test.
Reporting Security Issues
Found a vulnerability in BountyHarness itself? See SECURITY.md on GitHub. Do not open a public issue for security reports.