Bug bounty report check
Paste a draft and attach the files it cites. Seventeen checks answer at once: what is on the page, what is missing, which sentence a triager will quote back at you, and which citation points at nothing.
Your content never leaves the browser.
Markdown or plain text. The checks run as you type.
Attach the files it cites Optional
Source, test output or logs. Each file:line in the draft is checked against them. Up to 49 text files, 120 KB each, 240 KB with the draft.
Paste a file instead
No files attached.
Result
No report checked yet
Paste a draft, or load the example, to see each check with the line it found.
Citations
No file:line citations in the draft yet.
- Not run
Title states mechanism and consequence
- Not run
Scoped asset named
- Not run
Pinned revision
- Not run
Impact row quoted verbatim
- Not run
Severity stated once and consistent
- Not run
Trusted roles in the attack path
- Not run
Proof inline with command and output
- Not run
Final assertion on a balance, owner or stored record
- Not run
Mocks and pranks of privileged roles
- Not run
Transactions sent to a live network
- Not run
Prior-art reference stated
- Not run
Limits and non-claims stated
- Not run
AI use disclosed
- Not run
Self-negating phrases
- Not run
Placeholders and assistant leftovers
- Not run
Secrets and private report links
- Not run
Local paths
The seventeen checks
Each result is one of three states. Pass: the expected text is on the page, with the line that carries it. Missing: no matching evidence is stated, or the draft says the check was not done. Flagged: a line was found that a triager closes on, quoted so you can fix it.
| Check | What it looks for | Fix when it is open |
|---|---|---|
| Title states mechanism and consequence | What it looks forThe first heading or Title line names what the code does wrong and what is lost, locked, read, bypassed or blocked. | Fix when it is openWrite the title as one sentence: what the code does wrong, then what the attacker gains or the user loses. |
| Scoped asset named | What it looks forA scope, asset or target line carries an address, a repository link or a file. | Fix when it is openName the asset exactly as the programme lists it: the contract address or the repository path. |
| Pinned revision | What it looks forA commit hash, or a code link that contains one. A link to a branch is flagged. | Fix when it is openState the commit the finding was reproduced on and link every code reference at that commit. |
| Impact row quoted verbatim | What it looks forAn impact line with the programme’s row in quotation marks or in a quote block. | Fix when it is openCopy the impact row from the programme page word for word and put it in quotation marks. |
| Severity stated once and consistent | What it looks forOne severity level. A range or conflicting levels are flagged. An explicit CVSS 3.1 base vector is checked against a labelled score on the same line; metric choices are not verified. | Fix when it is openState one severity at the row the body argues, and check the number and chosen metrics when a CVSS score differs from its vector. |
| Trusted roles in the attack path | What it looks forNumbered attack steps that name owner, admin, keeper, operator or governance. | Fix when it is openLabel who performs each step; a decisive step by a trusted role ends the report. |
| Proof inline with command and output | What it looks forA run command and the output it printed, in the report body. A link alone is flagged. | Fix when it is openPaste the exact command and the output it printed into the report body. |
| Final assertion on a balance, owner or stored record | What it looks forAn assertion in the proof that reads a balance, an owner or a stored value. | Fix when it is openEnd the proof with an assertion that reads the object the impact row names. |
| Mocks and pranks of privileged roles | What it looks forA prank of a role-named address, a mock, or a forced state write in the proof. | Fix when it is openReach each state through public calls from live state, or name the mocked step and its route. |
| Transactions sent to a live network | What it looks forA cast send or forge script --broadcast aimed at a remote node, a Hardhat run on a named network, or a link to a transaction the report says you sent. | Fix when it is openReproduce on a local fork with anvil or forge test --fork-url and send nothing to a live network, since Immunefi bans testing on mainnet or a public testnet. |
| Prior-art reference stated | What it looks forA known issue, audit note, earlier report or search result, beyond a heading or an explicit not-checked statement. | Fix when it is openName the nearest known issue or audit note, compare the root cause and whether the same fix applies, or record the completed search and its result. |
| Limits and non-claims stated | What it looks forA limits section, or a sentence that says what the report does not claim. | Fix when it is openAdd two or three lines that say what the proof does not show and what you are not claiming. |
| AI use disclosed | What it looks forA line that says which AI tools helped find or write up the finding and what they did, or that none did. | Fix when it is openAdd one line that names the AI tools you used and what they did, or says you used none, since Intigriti requires it and GitHub’s report form asks. |
| Self-negating phrases | What it looks forSentences that contain: closest impact, if compromised, assuming, could potentially, currently zero, can be avoided by, does not establish. | Fix when it is openProve the condition each sentence concedes, or cut the claim that depends on it. |
| Placeholders and assistant leftovers | What it looks forPlaceholders such as [insert …], <your …>, TBD or TODO:, and sentences an assistant wrote to you, such as “As an AI” or “I hope this helps”. | Fix when it is openFill in or delete every placeholder and cut every sentence the assistant wrote to you. |
| Secrets and private report links | What it looks forKeys, tokens, seed phrases, private platform links, email addresses and public IP addresses. | Fix when it is openRemove each listed line and rotate any key that was pasted anywhere. |
| Local paths | What it looks forHome-directory paths such as /home/name/ or C:\Users\name\. | Fix when it is openReplace each local path with a repository-relative path. |
CVSS arithmetic follows FIRST’s CVSS 3.1 specification; the check does not validate the chosen metrics.
Seven phrases that close a report
Each one concedes a point before the triager has to make it. The check quotes the sentence so you can prove the condition or cut the claim. Under your own Limits heading they are stated non-claims and are not flagged.
- “closest impact”
- Says the selected impact row does not fit.
- “if compromised”
- Makes a trusted party the attacker.
- “assuming”
- States a precondition with no route to it from live state.
- “could potentially”
- Describes an outcome the proof did not produce.
- “currently zero”
- Says nothing is at risk today.
- “can be avoided by”
- Names an action that removes the loss.
- “does not establish”
- Concedes the claim is unproven.
What a report that lands contains
- An executed proof with its command and output, and a control case.
- A final assertion on the object the impact row names: a balance, an owner, a stored record.
- The exact code location on a pinned revision, and a concrete fix.
- A title that states mechanism and consequence in one sentence.
- Numbered attack steps, kept separate from test code.
- The impact row quoted verbatim.
- Limits and non-claims stated by the author, and the nearest known issue compared by root cause and whether the same fix applies.
The list comes from 105 real case files across five platforms, the paid ones and the closed ones. For a blank page, start from a report template or the report guide. What a closed report costs on each platform is on invalid report costs.
Questions
Where does my draft go?
Nowhere. The seventeen checks and the citation check are JavaScript that runs in this tab, and the page sends no request with your text or your files. After the page has loaded it sends two counters at most, with nothing of yours in either: one says the page was seen, the other that the tool was used. Pressing “Run the full challenge on your model” opens a review with the draft and its files loaded, through this browser’s session storage. A model sees them only when you run that review.
What does 17 of 17 tell me?
That the draft contains the text these checks look for: a commit, a quoted impact row, one severity, an inline proof with its output, a prior-art reference or search result, and a line on AI use. The check does not verify comparison quality or duplicate status. The full challenge reviews the claims against the evidence you supply.
How does the citation check work?
Attach the files your draft cites. Every citation such as src/Vault.sol:42-48, Vault.sol#L42 or input-1/src/Vault.sol:42 is matched to an attached file, and the cited lines open in place. A citation to a file you did not attach, a line past the end of the file, or a short name that matches two files is listed so you can fix it before a triager finds it. Links to websites are counted, never opened.
What is the evidence packet?
One JSON file with the draft, the attached files and a SHA-256 checksum of each. Open it here later to carry on with the same files; a file that changed since it was saved is refused. It holds your full draft and files, so keep it private.
Which report formats does it read?
Markdown and plain text. Immunefi, Cantina, Sherlock and HackerOne reports all carry these parts, under different headings. The checks look for the content, so the heading names do not matter.
Does it check CVSS scores?
The severity check compares an explicit CVSS:3.1 base vector with a labelled score on the same line, for example “CVSS score: 9.8 (CVSS:3.1/…)” or “CVSS:3.1/… = 9.8”. It uses FIRST’s CVSS 3.1 formula. It checks the arithmetic, not whether the metrics describe the finding. A report does not need CVSS. Other versions and Temporal or Environmental scores are left for manual review.
The text is in order. Now test the claim.
A review on your own model splits the draft into claims and marks each one confirmed, overstated, contradicted or unverifiable, with the line that decides it.