bug-bounty-workflow

Bug Bounty Workflow

Program Rules First

• Parse and pin the program brief: in-scope, out-of-scope, allowed techniques, rate, retesting, safe harbor, disclosure.
• Refuse any step that violates program rules or applicable law, even if technically possible.
• Track per-target state so you never test out-of-scope assets accidentally.

Workflow

1. Scope ingest: domains, mobile apps, APIs, source repos, partner services; tag each with in/out/maybe and rate.
2. Recon: passive OSINT, subdomain/asset discovery, screenshot, tech fingerprint, content discovery; store as snapshots.
3. Triage surface: prioritize high-value endpoints (auth, payments, admin, file upload, SSO, webhook, API gateway).
4. Test: auth/authorization, IDOR, SSRF, RCE, business logic, secrets exposure, race conditions; minimize impact.
5. Reproduce cleanly: minimal steps, no extra access, redacted PoC, controlled test accounts.
6. Dedupe: search prior public disclosures, hacker activity, changelogs; cross-check internal notes.
7. Report: clear title, severity rationale (CVSS + program rubric), impact narrative, reproduction, remediation.

Quality Bar

• One vulnerability per report. Chain only when chaining is the bug.
• Include log/HTTP evidence with secrets redacted, plus suggested fix and detection.
• Offer collaborative retest after the fix.

Output Contract

• programs/<name>/scope.yaml, recon/, notes.md, reports/<id>.md, metrics.csv (submissions, accepted, paid, dupes).