Pre Bounty

Pre-bounty: scope recon & target prioritization

The core thesis

Most hunters converge on whatever is cheapest to start testing. That means the crowd is an artifact of the setup barrier, not of where the bugs are. So the edge is systematic: rank the scope by

opportunity ≈ (payout ceiling × freshness) ÷ crowd, with setup difficulty acting as a moat - a hard-to-reproduce environment keeps competitors out, so it is a positive when paired with a high ceiling.

The whole skill exists to compute that ranking from real program data and show it in a way the user can act on. A high max-payout asset that is trivial to set up and already swept (lots of resolved reports) is a worse target than a modest one nobody has tooled up for. Make that legible.

Inputs this skill accepts

Any of, in order of preference:

• A program URL - hackerone.com/<program>, bugcrowd.com/<program>, app.intigriti.com/..., yeswehack.com/..., or a self-hosted /security / security.txt / VDP page.
• A pasted scope table or asset list (domains, mobile apps, repos, APIs).
• A rough description of API/repo access the user already has.

If you only get a program name, construct the URL. If the platform page is JavaScript-rendered (HackerOne, Bugcrowd, Intigriti all are), use the browser tools to read it - WebFetch returns an empty shell for these. read_page / get_page_text on the policy and scope tabs is the reliable path.

Workflow

Work the five stages in order. Stages 1–3 are parallelizable - fire the fetches and searches together.

1. Gather the scope (the signal-richest step)

Pull and record, per asset:

• Asset name, type (domain / mobile / desktop / API / source / other) and whether it is in or out of scope.
• Payout tier - most programs tag assets into tiers (HackerOne Core/Non-core; Bugcrowd P1–P5 targets; others "critical eligible" vs not). Capture the max reward reachable per asset - this is the ceiling.
• Resolved-report count / share per asset if the platform shows it. This is your single best crowd proxy - an asset with 40% of all resolved reports is picked-over; one with <2% is open. HackerOne shows this on the scope table; Bugcrowd/Intigriti show submission stats less granularly (note when missing).
• Last-updated date of each scope entry → freshness. Recently added or rescoped assets have had fewer eyes.
• Program-wide reward table (per-severity bounty ranges + averages) and the severity mix of resolved reports if shown.

See references/sourcing.md for exactly where each platform surfaces these.

2. Mine bug history

• Check the program's hacktivity / disclosed reports. Many programs disclose nothing publicly - say so plainly and fall back to the crowd proxy.
• Web-search public CVEs and researcher writeups for the target's products. The recurring bug class tells you what actually lands (e.g. trust-boundary RCE, config-precedence, deep-link/IPC on native clients). Record specific CVE IDs where found.
• Note remediation / dedup signals - if the policy says a bug class is under a wholesale fix, reports there will close as duplicates. Flag those assets as saturated regardless of payout.

3. Extract the boundary gotchas

The fine print is where hunters waste days. Capture:

• Adjacent in/out pairs - cases where a near-identical bug is in-scope on one asset and out on another (e.g. first-party MCP in-scope vs OSS MCP out; first-party connector in vs third-party-in-directory out).
• Excluded vulnerability classes (DoS, clickjacking on non-sensitive pages, missing cookie flags, dependency confusion, self-XSS, rate-limiting, etc.).
• Platform-standard deviations and payout nerfs - especially "one bounty per systemic issue" and discretionary PII-leak severity, which kill the "report many instances" strategy.
• Testing constraints (e.g. leaked-key "authenticate then immediately deauth only", required X-HackerOne-Handle header / researcher email).

Render this as a compact in ✅ / out ❌ table - see the output spec.

4. Score & rank every asset

Apply the rubric in references/scoring.md. For each asset produce: { setup tier + time estimate, crowd, payout ceiling, freshness, ROI verdict, opportunity score 0–100 }, then sort best→worst. Verdict buckets: Prime · Good · Recon · Skip · Dead. Be honest that the two highest-ceiling assets are often near the bottom because the crowd is already there - surfacing that inversion is the point.

5. Deliver

Produce the artifacts below. Lead with the ranking; it is what the user asked for even when they phrased it as "analyze the scope".