1---2name: bug-bounty-workflow3description: Bug bounty workflow skill for program scope mapping, recon-to-report automation, deduplication against prior submissions, and high-signal reporting on HackerOne, Bugcrowd, Intigriti, YesWeHack, and self-hosted programs. Use to organize bounty work end to end while staying inside program rules.4---56# Bug Bounty Workflow78## Program Rules First910- Parse and pin the program brief: in-scope, out-of-scope, allowed techniques, rate, retesting, safe harbor, disclosure.11- Refuse any step that violates program rules or applicable law, even if technically possible.12- Track per-target state so you never test out-of-scope assets accidentally.1314## Workflow15161. Scope ingest: domains, mobile apps, APIs, source repos, partner services; tag each with `in/out/maybe` and rate.172. Recon: passive OSINT, subdomain/asset discovery, screenshot, tech fingerprint, content discovery; store as snapshots.183. Triage surface: prioritize high-value endpoints (auth, payments, admin, file upload, SSO, webhook, API gateway).194. Test: auth/authorization, IDOR, SSRF, RCE, business logic, secrets exposure, race conditions; minimize impact.205. Reproduce cleanly: minimal steps, no extra access, redacted PoC, controlled test accounts.216. Dedupe: search prior public disclosures, hacker activity, changelogs; cross-check internal notes.227. Report: clear title, severity rationale (CVSS + program rubric), impact narrative, reproduction, remediation.2324## Quality Bar2526- One vulnerability per report. Chain only when chaining is the bug.27- Include log/HTTP evidence with secrets redacted, plus suggested fix and detection.28- Offer collaborative retest after the fix.2930## Output Contract3132- `programs/<name>/scope.yaml`, `recon/`, `notes.md`, `reports/<id>.md`, `metrics.csv` (submissions, accepted, paid, dupes).
Masriyan