elementalsouls/claude-bughunter

Claude-bughunter turns Claude Code into a specialized security research assistant for finding vulnerabilities in websites, APIs, and enterprise infrastructure. Instead of writing your own prompts or keeping a folder of bookmarks to reference past security reports, you install this bundle once. Then you just describe what you're testing in plain English, and the assistant automatically loads the right techniques, attack patterns, and reporting formats for that specific type of engagement. The bundle is built around four layers that work together. The first is a methodology framework that keeps your testing structured and disciplined. The second is a set of web application hunting skills, drawn from 681 real disclosed bug bounty reports, covering common vulnerability classes like cross-site scripting or broken authentication. The third layer targets enterprise infrastructure, things like Microsoft 365, Okta, VPN appliances, and cloud configurations, using known attack chains and recent vulnerabilities. The fourth layer handles reporting and evidence hygiene, making sure findings are properly validated, sensitive data is redacted from screenshots, and reports match what platforms like HackerOne or Bugcrowd expect. This is designed for bug bounty hunters, penetration testers, and external red-team operators who have written authorization to test targets. For example, if you're testing a company's public-facing web app for a bug bounty, you can ask the assistant to run reconnaissance, map the attack surface, and probe for specific issues like GraphQL misconfigurations or OAuth flaws. If you're doing an enterprise red-team engagement, it can help you look for known vulnerabilities in a company's VPN or identity provider after you've gained initial access. What's notable is how deliberately the project scopes itself. It focuses entirely on external attack surfaces, things reachable from the internet, and explicitly excludes internal network attacks, post-exploitation tools, or malware development. The bundle also includes built-in validation gates that prompt you to confirm you're authorized to test a target before proceeding, and it flags that Anthropic's own safeguards may require you to enroll in a verification program for legitimate security work.