Gabson0x/bountyforge

What it solves

BountyForge automates the complex process of security auditing and bug hunting for web APIs and smart contracts. It replaces manual, fragmented scanning with a coordinated system of AI agents that can identify vulnerabilities, validate them through a rigorous gating process, and generate professional reports ready for submission to bug bounty platforms like HackerOne and Immunefi.

How it works

The system orchestrates eight specialized AI agents in parallel, each focusing on a specific attack surface (such as business logic, race conditions, or economic security). These agents can be integrated with Claude Code to execute local CLI security tools (e.g., nmap, sqlmap, ffuf).

Every potential finding must pass through a four-gate validation process to reduce false positives:

1. Refutation: Checking if existing guards block the attack.
2. Reachability: Determining if the vulnerable state is possible in live deployment.
3. Trigger: Verifying if an unprivileged actor can execute the attack.
4. Impact: Confirming material harm to a victim.

Findings are then deduplicated, scored using CVSS 3.1, and formatted into platform-specific reports.

Who it’s for

It is designed for security researchers and bug bounty hunters who want to accelerate their reconnaissance and auditing workflow across EVM, Move, Solana, and TRON smart contracts, as well as standard web and API infrastructure.

Highlights

• Parallel Agent Architecture: Deploys 8 specialized agents simultaneously to cover diverse vulnerability classes.
• Local Tool Orchestration: Integrates with industry-standard CLI tools like nmap, gobuster, and zap via Claude Code.
• Rigorous Validation: Uses a multi-gate evaluation system to filter out "AI slop" and false positives.
• Platform-Ready Output: Generates submission-ready reports tailored for HackerOne, Bugcrowd, Intigriti, and Immunefi.
• Cloud Sandbox Option: Offers isolated Firecracker microVMs via bountyforge.xyz for users who don't want to manage their own environment.