Gabson0x/bountyforge
405 stars · Last commit 2026-08-29
All-round bug bounty skill for Claude Code parallelized agents for smart contract audits (EVM, Move, Solana, TRON), web/API security, and submission-ready reports for HackerOne, Bugcrowd, Intigriti & Immunefi.
README preview
# bountyforge > All-round bug bounty skill for Claude Code — parallelized agents for smart contract audits (EVM, Move, Solana, TRON), web/API security, local tooling orchestration, and submission-ready reports for HackerOne, Bugcrowd, Intigriti & Immunefi. > **AI Pentesting Tool:** Run isolated, cloud-hosted pentesting sandboxes at **[bountyforge.xyz](https://bountyforge.xyz)** — your AI key, your Firecracker microVM, your report. Pipeline: recon → hunt → triage → H1-ready report. AI slop gets you rate-limited; BountyForge gets you paid. > **New in v3.1.0:** Al-Mizaan v3 deep validation gates, SIS-MD passive intelligence integration, agent isolation checks. See [CHANGELOG.md](CHANGELOG.md). --- ## What It Does Bounty Forge spins up **8 specialized security agents in parallel**, each attacking a different surface of your target. Findings are deduplicated, gate-evaluated, CVSS-scored, and formatted into a submission-ready report — in minutes. | Agent | Covers | |---|---| | Web / API | Auth bypass, IDOR, XSS, SSRF, SQLi, CSV injection, open redirect, path traversal, parameter pollution, GraphQL, CORS | | Smart Contract | EVM, Move/Aptos, Solana, TRON — structural & chain-specific bugs | | Access Control | Role bypass, init hijack, confused deputy, proxy admin |