Skip to main content
RaSEC
Sign inStart hunting

Workflow

Disclosure process

Four stages from scope to submission. No shortcuts. Every finding validated before you see it.

Start hunting free →View guidelines

Four-phase disclosure flow

01Scope — Import and lock scope from HackerOne or Bugcrowd
02Execute — Agentic hunt within enforced scope boundaries
03Validate — Deterministic curl replay — CONFIRMED findings only
04PoC report — Structured evidence bundle, ready to submit

Why process matters

The bar hunters are held to

Bug bounty triage teams reject a large proportion of AI-assisted submissions. The most common reasons: findings not reproducible, insufficient evidence, scope not verified, and report format not matching program requirements. These are process failures, not tool failures.

Curl shut its entire bug bounty program citing AI spam. HackerOne data shows "AI slop" — shallow, unverified AI-generated reports — as a top triage complaint in 2025. The hunters who succeed with AI tooling are those who enforce the same discipline on AI output that they would on their own manual work.

RaSEC Hunt enforces this discipline at the system level, not just as a workflow suggestion. Scope is locked before execution. Findings require deterministic reproduction. Reports are formatted for the target platform. The process is not optional.

The four-stage disclosure flow below is what separates a submission-ready finding from an alert. Every step is designed to meet the bar that triage teams actually hold submissions to — not the bar that seems acceptable when you are looking at your own tool output.

From scope to submission

Four stages. No shortcuts.

01

Define scope

Lock boundaries before execution starts

You import your program scope directly from HackerOne or Bugcrowd JSON, or paste it manually as a list of domains and wildcard patterns. The scope policy is locked when the session starts and cannot be modified mid-hunt by the agent or by any control-plane instruction. This is not a UI permission — it is enforced at the transport layer.

  • Import scope JSON from HackerOne or Bugcrowd directly
  • Wildcard patterns, subdomain rules, and URL prefix matching supported
  • Scope rules are version-locked per session with a hash fingerprint
  • Localhost, internal IP ranges, and cloud metadata endpoints blocked by default
  • Scope violations logged as first-class audit events, not silently skipped
02

Execute mission

Agentic hunting with full operator visibility

The Coordinator Agent runs your hunt using a ReAct loop (Reason, Act, Observe) in a background worker that survives browser close. Every step — recon, attack dispatch, tool call, and validation attempt — is streamed to your Mission Control dashboard via Server-Sent Events. You can pause, resume, or inject a steering instruction at any point without interrupting the session.

  • ReAct loop: Reason → Act → Observe, repeated until mission complete
  • Background execution via Upstash QStash: hunt continues after you close the browser
  • SSE stream: every tool call, decision, and finding streamed live to your dashboard
  • Specialist agents: ReconAgent, HeadersAgent, JWTAgent, LogicAgent, DASTAgent
  • Pause / resume / steer controls always available mid-hunt
03

Validate findings

No promotion without deterministic reproduction

Every potential HIGH or CRITICAL finding is routed through the ValidationAgent before it appears on your board. The agent attempts deterministic reproduction up to three passes, compares request/response diffs, and assigns a CONFIRMED or REJECTED state. A finding stays in PENDING until reproduction either succeeds or runs out of attempts. There is no optimistic promotion.

  • ValidationAgent: up to 3 deterministic reproduction attempts per finding
  • HTTP request, response, and diff saved as immutable evidence
  • CONFIRMED, PENDING, and REJECTED states tracked explicitly
  • Failed reproductions logged with explanation — not silently dropped
  • CVSS severity assigned only after CONFIRMED state reached
04

Deliver PoC report

Copy. Paste. Submit.

The PoCAgent generates a platform-specific report from the confirmed finding evidence chain. The report includes a vulnerability summary, CVSS score, step-by-step reproduction instructions, a ready-to-run curl command, the HTTP evidence diff, and an impact analysis written for the bounty triage team. Output templates are available for HackerOne, Bugcrowd, Intigriti, and custom markdown.

  • Platform templates: HackerOne, Bugcrowd, Intigriti, custom markdown
  • Reproduction steps generated from the live agent trace — not written by hand
  • Curl command included and verified against the confirmed response
  • Evidence diff: before/after HTTP baseline comparison for full context
  • Export as markdown for copy-paste or PDF for internal review handoffs

How we compare

Hunt vs. typical automated tooling

AspectRaSEC HuntTypical automated tool
Scope enforcementTransport-layer block before network callUI checkbox or honor system
Finding statePENDING / CONFIRMED / REJECTED tracked explicitly"Severity: HIGH" with no reproduction evidence
ValidationDeterministic reproduction required for promotionHeuristic match or LLM-confidence score
Report formatHackerOne/Bugcrowd template with curl + diffRaw JSON export or generic text block
Operator visibilityEvery agent step streamed liveProgress bar, then results
Overnight supportBackground worker survives browser closeScan fails if session expires
RaSEC Platform

Run your first scope-safe agentic hunt

Scope-safe from the first click
Validated findings only
Submission-ready PoC reports
Start a hunt →Explore bug classes
No credit cardCancel anytimeFree forever tier