pwnote-bug-bounty
Installation
SKILL.md
Bug Bounty Workflow
Reference for running a bug bounty engagement end-to-end: program intake, recon, vulnerability classes, report writing, and triage disputes. Output should be structured so it can be pasted directly into a pwnote engagement file (see the pwnote-engagement-file skill if present) — findings map to the findings array, recon steps map to docs/blocks.
1. Program Intake
When given a program's scope page (or a pasted policy), extract into a structured note:
| Field | Notes |
|---|---|
| In-scope assets | domains, IP ranges, app names, mobile app IDs, source repos |
| Out-of-scope | explicit exclusions — always check for staging/subdomains carved out |
| Reward table | severity → payout, so you can prioritize effort against expected value |
| Special rules | rate limits, no-automated-scanning clauses, social engineering restrictions, disclosure timeline requirements |
| Safe harbor language | confirm it exists before doing anything invasive |
Always re-read scope before starting active testing — programs change scope frequently and testing out-of-scope assets voids safe harbor.