# Bug Bounty Methodology

> Use when participating in bug bounty programs.

- Skill: `loopyluci/bug-bounty-methodology` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/bug-bounty-methodology`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/bug-bounty-methodology/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/bug-bounty-methodology

---


# Bug Bounty Methodology

Participating in bug bounty programs — from platform selection and recon through vulnerability discovery, report writing, and disclosure.

## When to Use

- Hunting bugs on HackerOne, Bugcrowd, or Intigriti
- Building a systematic bug hunting methodology
- Writing effective vulnerability reports
- Prioritizing targets and attack surfaces

## Bug Hunting Methodology

```python
BUG_BOUNTY_WORKFLOW = {
    'target_selection': 'Choose programs by scope, bounty range, response time, reputation',
    'recon': 'Subdomain enumeration, port scanning, technology fingerprinting, Wayback Machine',
    'automation': 'Nuclei templates, custom scripts for mass scanning',
    'manual_testing': 'Deep dive on interesting endpoints, business logic, auth flows',
    'exploitation': 'Validate PoC, maximize impact, chain vulnerabilities',
    'reporting': 'Clear, reproducible, triage-friendly report',
}

class BugBountyHunter:
    """Track bug bounty findings and earnings."""
    def __init__(self):
        self.findings = []
        self.total_earnings = 0.0
    
    def submit_finding(self, program: str, vulnerability: str, 
                        severity: str, payout: float = 0):
        self.findings.append({
            'program': program, 'vuln': vulnerability,
            'severity': severity, 'payout': payout,
        })
        self.total_earnings += payout
    
    def stats(self) -> Dict:
        return {
            'total_findings': len(self.findings),
            'total_earnings': self.total_earnings,
            'by_severity': {s: sum(1 for f in self.findings if f['severity'] == s)
                           for s in ['critical', 'high', 'medium', 'low', 'info']},
        }
```

## Verification Checklist

- [ ] Program scope reviewed (in/out, eligible domains, testing rules)
- [ ] Reconnaissance phase (subdomain enumeration, technology detection, endpoint discovery)
- [ ] Automated scanning (nuclei, custom tools)
- [ ] Manual testing on high-value targets (auth, payment, PII)
- [ ] Impact maximization (chaining vulnerabilities)
- [ ] Report written with reproducible steps
- [ ] Proof of concept ready (screenshots, requests, scripts)
- [ ] Disclosure timeline: report → triage → fix → public disclosure
- [ ] Program-specific rules followed (rate limits, testing times, no social engineering)