Hunt for security bugs like a team: give Claude Code a playbook built from 700+ real disclosed reports, and only test targets you're authorized to test: AI agent prompt
Asking an AI to "find bugs" gets noise. A free open-source kit, Claude-BugHunter, packs 83 security skills and 700+ patterns from real disclosed bug reports into Claude Code, and walks a set path: confirm scope, map the attack surface, hunt by vulnerability type, reproduce and kill false positives, then write a report triage teams actually read. Payouts aren't guaranteed, and testing anything outside an authorized program's scope is illegal.
SecurityBug bounty & testingadvancedThe prompt
I'm doing authorized security testing. The program is [bug bounty program or my own app], and its scope rules are: [paste in-scope targets, out-of-scope items and testing rules]. Work in this order and stop to ask me before any step that could change data or send many requests. 1) Restate the scope and list anything you will NOT touch. 2) Map the attack surface from what I give you (URLs, API docs, JavaScript files, features): list features worth testing and why. 3) For each, name the likely vulnerability types (for example access-control mistakes, injection, SSRF, auth bypass) and a safe, low-impact test. 4) When I paste a result, decide: real issue, false positive or needs more proof, and say what evidence is missing. 5) For confirmed issues, write a report: title, severity with reasoning, affected endpoint, steps to reproduce, impact, evidence and a suggested fix. Never test outside scope, never access other users' real data beyond what's needed to prove the issue, and never run denial-of-service tests.
How to use it
- Copy the prompt above.
- Replace every [bracket] with your own details (or fill in the blanks on AgentPlaybook Real Estate, which remembers your answers for the next prompt).
- Paste it into Claude Code, Claude-BugHunter, Burp Suite and review the answer before you use it.
Works with: Claude Code, Claude-BugHunter, Burp Suite
Real-world example: github.com/elementalsouls/Claude-BugHunter
Featured in: AI prompts for writing SOPs, reports, policies and checklists
Before you use it: what to check
Already built into this prompt
- Never test outside scope, never access other users' real data beyond what's needed to prove the issue, and never run denial-of-service tests.
- Work in this order and stop to ask me before any step that could change data or send many requests.
Check yourself
- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Check names, dates, numbers and any claim against your own source material before you use the answer. AI can misread or invent details.
Using an AI agent? Download this prompt as a SKILL.md agent skill with these checks built in, or get the .zip for Claude.ai. How to install skills.
Want to make this prompt even better? Grade it with the free prompt grader or build your own with the AI prompt generator.
32 copy-paste agent prompts (PDF) plus 5 new prompts every week.
Get it free