awesome-bug-bounty

# Awesome Bug Bounty Distilled knowledge base for bug bounty hunting and authorized security research. **Paths below are relative to this skill's directory.** Prefer them; only fetch source repos (Fallback table) when deeper detail is needed. ## Operating rules 1. Read extended detail from `knowledge/*.md` before improvising: - `knowledge/vuln-types.md` — per-vuln hunt focus + example patterns - `knowledge/payloads.md` — payload/bypass cheat sheet by context - `knowledge/business-logic.md` — business logic + race condition playbooks - `knowledge/methodology.md` — recon/API methodology, best practices, non-duplicated engagement path, report template, wordlists - `knowledge/tools.md` — tool-choice matrix: proxies, AI-native hunters, Obscura, MCP stack, authz/API/bizlogic tools - `knowledge/install.md` — install commands + post-install setup (API keys, proxy CA, MCP registration) 2. For writeup links, full payload lists, or tool internals: fall back to source repos via registered opencode references (`@awesome-bb-writeups`, `@bug-bounty-reference`, `@payloads-all-the-things`, `@hack-skills`, `@bizlogic`, `@aw-junaid-bug-bounty`, `@hackerone-reports`, `@autorizepro`, `@burp-api-security-suite`, `@awesome-bugbounty-tools`, `@obscura`, `@caido-skills`) or the Fallback table URLs. If a reference isn't registered, use the GitHub URL. 3. **Authorized testing only.** Stay inside program scope and rules of engagement. 4. Evidence standard for reports: clear impact, ...