responsible-disclosure

Open-source vulnerability disclosure and bug bounty program database

Reusable prompts for a structured, evidence-first bug bounty hunting workflow

⚔️ Community maintained directory, MCP and API of 3,000+ active bug bounty programs and VDPs

Open-source vulnerability disclosure policy templates.

CVE hunting harness for Claude Code - 20 skills, 5-agent team, systematic vulnerability research with false positive elimination

security.txt collection of most popular world-wide domains

A structured, versioned archive of adversarial prompt engineering techniques against Large Language Models — for AI safety research, red-teaming, and defensive hardening.

CWE-602 客户端鉴权脆弱性白盒审计方法论与纵深防御加固研究框架

Mechanism-grounded taxonomy of 40 LLM jailbreak patterns across 10 categories. 8,000-trial bootstrap evaluation for the June 2026 frontier (Claude Opus 4-8, GPT-5.5, Gemini 3.5, DeepSeek V4). Every citation direct-WebFetch verified; refuted claims documented.

A nonprofit, open-source vulnerability disclosure platform built for security researchers.

Find sites vulnerable to github subdomain takeover

⚠️ Active 0-day exploit allowing any Discord server to be permanently terminated via automated pipeline abuse. Research, attack analysis, and protection guide for server owners. Unpatched as of April 2026.

Coordinated Vulnerability Disclosure Policy

Automated Bash script to verify WordPress XML-RPC system.multicall vulnerabilities. Designed for responsible disclosure processes to demonstrate bypasses of traditional rate-limiting.

🛡️ Discover and analyze critical vulnerabilities in Meta AI's Instagram Group Chat, ensuring robust security through comprehensive testing and reporting.

Exact-model scanners for publicly known weak-RNG Bitcoin wallet vulnerabilities (Milk Sad, Trust Wallet, COLDCARD Mk2/3) plus HNP lattice attack PoC.

ArubaOS 8.13.2.0 pre-auth attack surface research. XXE+SSRF, ICMP reflection, buffer over-read, hardcoded credentials — all submitted to HPE Bugcrowd, marked N/A. No fixes issued.

MCP server security testing framework

Forensic audit of mcp-remote: seven OAuth trust-boundary advisories, five CVE records (CVE-2026-51994/51995/51996/51997/52001). Server-selected request path (CWE-918) run against loopback canaries in 58 stable releases, 0.1.32 to the current 0.14.3; selected code and namespace signatures under 12 other npm names; search blind spots above 350 KiB.

Multiple Command Injection vulnerabilities in openhands <0.62.0 allow an attacker to run arbitrary system commands.