Releases·Tool Release
BundleBleed: AI-assisted JavaScript recon and vulnerability triage for authorized bug bounty and pentesting
BundleBleed, a new open-source tool for authorized bug bounty and pentest work, collects a target's client-side JavaScript and server-rendered pages, extracts endpoints, secrets, subdomains, parameters, and DOM-XSS sink/source pairs, and scores findings into explainable hypotheses. It runs fully without an LLM but can plug in Claude, Ollama, or OpenRouter models to classify endpoints, draft reports, and surface attack chains with citations. It matters to practitioners by prioritizing the highest-signal leads during short engagements.
27 engagement1 sourceSun, Sep 13, 2026, 02:24 PM
AI Overview
- BundleBleed collects client-side JS and server-rendered pages, extracting API endpoints, secrets, subdomains, parameters, and DOM-XSS sink/source pairs
- Full pipeline runs with zero LLM, API key, or third-party account; optional LLMs include Claude, self-hosted Ollama, and OpenRouter models
- Every finding is scored on signals like login-gated visibility, runtime requests, vulnerability shape matches, and prior scans to produce explainable hypotheses
- LLM use covers endpoint classification, human-readable report drafting, and attack-chain surfacing, with claims cited back to scan evidence
Related
Social·Community
The New Era of Vulnerability Hunting: Agentic AI Meets Bug Bounties | by Samadhan Shimple
A Medium article by Samadhan Shimple outlines using agentic AI to run bug bounty hunting end to end, from reconnaissance through a submission-ready report, all from the command line. It presents the workflow as accessible with or without a paid AI subscription.
A Medium article by Samadhan Shimple outlines using agentic AI to run bug bounty hunting end to end, from reconnaissance through a submission-ready report, all from the command line. It presents the workflow as accessible with or without a paid AI subscription.
0 engagement1 sourcerssThu, Oct 1, 2026, 05:51 AM
Releases·Tool Release
ClaudeBrain: open-source tool turns Obsidian vault into AI-powered pentest assistant
A developer released ClaudeBrain, an open-source tool that integrates Claude Code with an Obsidian vault to create an AI-powered knowledge base and automation harness for penetration testing and bug bounty hunting. The project aims to streamline offensive security workflows by combining LLM reasoning with structured note-taking.
A developer released ClaudeBrain, an open-source tool that integrates Claude Code with an Obsidian vault to create an AI-powered knowledge base and automation harness for penetration testing and bug bounty hunting. The project aims to streamline offensive security workflows by combining LLM reasoning with structured note-taking.
47 engagement1 sourcegithubTue, Jul 14, 2026, 07:25 AM
Releases·Tool Release
PromptXploit open-source LLM pentesting CLI released with local attack judging
A new open-source CLI tool called PromptXploit lets security testers run categorized attack prompts (injection, jailbreaks, tool abuse, extraction) against any LLM endpoint. It judges attack success locally via Ollama, ensuring sensitive responses never leave the user's machine. The tool is designed for pentesters, red-teamers, and developers auditing their own systems before shipping.
A new open-source CLI tool called PromptXploit lets security testers run categorized attack prompts (injection, jailbreaks, tool abuse, extraction) against any LLM endpoint. It judges attack success locally via Ollama, ensuring sensitive responses never leave the user's machine. The tool is designed for pentesters, red-teamers, and developers auditing their own systems before shipping.
3 engagement1 sourceredditWed, Jul 15, 2026, 07:58 AM
Products·launched
VibeGuard: Security scanner for AI-generated codebases
VibeGuard scans AI-generated codebases for common security flaws like unauthenticated API endpoints, hardcoded secrets, and SQL injection vulnerabilities. It uses LLMs to analyze code structure and flag risky patterns, helping founders who 'vibe code' with AI assistants avoid shipping insecure apps.
VibeGuard scans AI-generated codebases for common security flaws like unauthenticated API endpoints, hardcoded secrets, and SQL injection vulnerabilities. It uses LLMs to analyze code structure and flag risky patterns, helping founders who 'vibe code' with AI assistants avoid shipping insecure apps.
7 engagement2 sourcesreddit, hackernewsThu, Jul 16, 2026, 11:26 AM
Products·launched
Benchmark AI code reviewers on real CVEs with your own API key
A tool that feeds real known bugs (CVEs with actual fixes) to different AI models and scores whether they catch them. Users plug in their own API key to run on any model they already pay for, with no markup and no signup required to try. It reveals which models catch entire bug classes consistently and which miss them or add false positives.
A tool that feeds real known bugs (CVEs with actual fixes) to different AI models and scores whether they catch them. Users plug in their own API key to run on any model they already pay for, with no markup and no signup required to try. It reveals which models catch entire bug classes consistently and which miss them or add false positives.
1 engagement1 sourceredditTue, Jul 14, 2026, 04:19 PM