Claude Bug Bounty is an AI-powered bug bounty toolkit that runs in terminal, performing recon, scanning for vulnerabilities, validating findings, and generating submission reports. It supports standalone mode and Claude Code plugin, with multiple AI providers and a 20-web vulnerability class scope.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
A professional bug bounty hunting toolkit that works with or without a Claude subscription. It handles recon, tests for vulnerabilities, validates findings through a gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi. It can run as a fully standalone CLI (bughunter) powered by free AI providers or as a Claude Code plugin.
How it works
The workflow is a loop: /recon → /hunt → /validate → /report, with an optional /autopilot that runs the full loop. Sessions persist across hunts, enabling memory of past findings. Tools in the pipeline are gated on installation status; missing tools are skipped. Auth headers are carried through the tools (httpx, katana, ffuf, nuclei, dalfox).
Getting started
Standalone setup (no subscription):
git clone https://github.com/shuvonsec/claude-bug-bounty.git
cd claude-bug-bounty
./install.sh --agent standalone # creates system-wide 'bughunter' command
Then:
bughunter setup
bughunter recon target.com
bughunter hunt target.com
bughunter validate "my finding"
bughunter report
Other install paths include Claude Code plugin setup and zero-cost offline options using Ollama. See README for provider lists and commands like bughunter providers, bughunter status, and bughunter v/r shortcuts.
Recent releases
Releases show incremental improvements:
- v5.0.0 — False Positive Reduction + Repository Polish (2026-06-09)
- v4.0.0 — Meme Coin Security Module (2026-04-13)
- v3.0.0 — Bionic Hunter: Autonomous Mode + MCP Integrations (2026-03-26)
- v1.0.0 — Claude Bug Bounty Hunter (2026-03-13)
Traction
Stars: 4133 Forks: 738 Open issues: 16
What it finds
Twenty Web2 vulnerability classes include IDOR, Auth Bypass, XSS, SSRF, SQL Injection, MFA/2FA Bypass, SAML/SSO Attack, and others. Ten Web3 / smart contract bug classes include Reentrancy, Oracle Manipulation, and Incomplete Code Path, among others. Payouts are listed per vulnerability in the table sections of the README.
AI agents
Nine specialists cover distinct roles: recon, report writing, validator, web3-audit, chain-builder, autopilot, recon-ranker, token-auditor, credential-hunter.