Get from signup to PoC in five steps.

Create your account

Sign up at rasec.app/signup. The free tier is fully functional — no credit card required. You get one concurrent hunt session, surface-level findings, and 30-day data retention.

Define your hunt scope

Before launching, set your scope. Paste the program's in-scope domains and CIDR ranges. RaSEC Hunt gates every agent action against this boundary mathematically before execution.

# Example scope configuration
in_scope:
  - "*.example.com"
  - "api.example.com"
  - "10.0.0.0/8"  # internal range if permitted
out_of_scope:
  - "support.example.com"
  - "status.example.com"

Launch your hunt

Hit "Start Hunt". The agent begins recon: subdomain enumeration, endpoint discovery, JavaScript analysis, and coordinated vulnerability testing. All visible in the real-time mission log.

Review findings

Every finding has an explicit state: Pending (AI heuristic flagged), Validated (deterministic reproduction passed), or Rejected (false positive). Pro and Elite tiers include the curl command for manual verification.

# Finding lifecycle
Pending    → AI heuristic detected an anomaly
Validated  → Deterministic reproduction confirmed
Rejected   → False positive (agent discarded)

# You only act on: Validated

Export your PoC report

Select the validated finding and click "Generate PoC". The report formats itself to your chosen template: HackerOne, Bugcrowd, Intigriti, or custom. Copy the output and submit.