bug-bounty-validation

What this skill does

Provides a structured decision framework for validating bug bounty findings before submission. Runs a sequential gate system — 7-Question Gate, Always-Rejected List, Chain Requirement Evaluation, 4 Pre-Submission Gates, and CVSS 3.1 severity assessment — to produce a final verdict of SUBMIT, KILL, NEEDS CHAIN, or NEEDS IMPROVEMENT. Eliminates wasted submissions by catching invalid, out-of-scope, or low-quality reports before they reach the program.

When to use

• After discovering a potential vulnerability and before writing the full report
• When unsure whether a finding is worth submitting
• When a finding seems valid but impact is borderline
• When you have a low-severity finding and want to know if chaining elevates it
• When a triage response came back "Informational" or "N/A" and you want to understand why
• When reviewing a draft report for quality before final submission

Prerequisites

• A potential finding with at least one HTTP request/response pair demonstrating the behavior
• Knowledge of the target program's scope page (assets, exclusions, accepted vulnerability classes)
• Access to the program's policy page on HackerOne, Bugcrowd, Intigriti, or equivalent platform
• No external tools are required — this skill is a decision framework