Parses program scope assets, normalises identifiers, deduplicates wildcard expansions, and builds the canonical target surface for all downstream tools.

Crawls in-scope domains and APIs to enumerate reachable endpoints. Uses sitemap, robots.txt, and JS bundle analysis. Respects rate-limit policy.

Detects frameworks, libraries, CDNs, CMS platforms, authentication providers, and cloud services from response headers, HTML, and JS bundles.

Applies a library of 200+ regex + semantic patterns to endpoint observations, classifying potential vulnerability types: IDOR, XSS, SSRF, CSRF, RCE, SQLi, Auth Bypass, and 20+ more.

Cross-references current target observations against historical finding patterns. Surfaces recurring vulnerability families and helps prioritise high-yield attack paths.

Statistically models expected API behaviour baselines (response sizes, timing, status codes) and flags deviations that may indicate access control flaws or injection sinks.

Validates that attached evidence (request/response pairs, screenshots, logs) is coherent with the claimed vulnerability. Checks timestamps, headers, and payload consistency.

Validates every finding and target against the live program policy. Blocks out-of-scope submissions, flags caution assets, and attaches policy context to each finding.

Computes semantic similarity between the current finding and all existing findings in the program using vector embedding comparison and structural field matching.

Builds and traverses the knowledge graph of programs, assets, findings, and technologies. Surfaces structural relationships, trust boundaries, and attack paths.

Identifies vulnerability patterns shared across multiple targets and programs. Surfaces systemic weaknesses in shared infrastructure, CDN configurations, and authentication providers.

Tracks how program policies, scope, and bounty structures change over time. Alerts when high-value assets are added, bounty multipliers increase, or restrictions are lifted.

Uses AI to draft professional HackerOne-quality reports from structured finding data. Produces title, summary, reproduction steps, impact statement, and remediation notes.

Evaluates report completeness against HackerOne acceptance criteria. Scores on: reproduction clarity (0–25), impact strength (0–25), evidence quality (0–25), and policy compliance (0–25).

Handles the full HackerOne report submission lifecycle: pre-validation, API call with retry, response parsing, and status recording.

Periodically polls HackerOne for status updates on submitted reports. Syncs triage, bounty award, resolution, and duplicate states back into the platform.