bb-huge 🤗

🤗 Join the bb-huge Community!

Find friends, share ideas, and start discussions with pro bug bounty hunters and software developers/engineers. Join the bb-huge Discord Server

/bb-huge — one command. Multi-Domain Security Expert, loaded. Not a portal. A Context Engineering Architecture that converts your AI agent into a disciplined hunter across Web, Mobile, Binary, and Source Code with a single slash command. The web UI is the visible tip — the real power is the 350+ curated security skills injected into the agent's brain.

---

The Architecture

┌─────────────────────────────────────────────────────────────┐
│                    YOUR AI AGENT                             │
│  (gemini-cli / claude-code / codex / emmu / any MCP client) │
└──────────┬─────────────────────────────────────┬────────────┘
           │  "/bb-huge"                         │  "find bugs on
           │  triggers skill                     │   example.apk"
           ▼                                     ▼
┌──────────────────────────┐    ┌──────────────────────────────┐
│  SKILL.md                │    │  MCP stdio Server            │
│  • Multi-Domain Persona  │    │  • 35+ tools (CRUD + stats)  │
│  • 7 SOPs loaded         │◄──►│  • stdio transport           │
│  • Field Dispatch system │    │  • stateless, fast           │
│  • 350+ Curated Skills   │    │  • any agent, same API       │
└──────────┬───────────────┘    └──────────┬───────────────────┘
           │                               │
           ▼                               ▼
┌──────────────────────────┐    ┌──────────────────────────────┐
│  references/ (12+ files) │    │  PORTAL (Flask + SQLite)     │
│  • Mobile Methodology    │    │  • Dashboard (Field Grouping)│
│  • Binary Analysis       │    │  • Findings CRUD (4 domains) │
│  • Source Code Audit     │    │  • Programs + Auto-Summary   │
│  • Field-routed Templates│    │  • Observations/Hypotheses   │
│  • Recon, Standards      │    │  • Evidence pipeline         │
│  • Eligible Vulns        │    │  • Assets & Endpoints        │
└──────────────────────────┘    │  • REST API                  │
                                │  • Webhooks (Discord/TG)     │
                                └──────────────────────────────┘

Two systems, one interface. The skill layer gives the agent domain-specific knowledge & discipline. The portal layer gives it persistent multi-field memory. They communicate through MCP.

---

The Signal Pipeline

bb-huge captures bug bounty work at every confidence level, from vague suspicion to confirmed payout:

Observation ──promote──► Hypothesis ──promote──► Finding
   (signal)                (candidate)            (confirmed)

Each step preserves provenance — a promoted finding keeps a link back to the hypothesis and observation it came from, along with the evidence that supports it.

---

Why This Works

Every bug hunter has the same problem: context resets to zero every session.

You spend 30 minutes re-reading your own notes, re-downloading attachments, trying to remember where you left off. Between sessions, you forget the half-baked hypothesis, the endpoint you were about to fuzz, the parameter that looked interesting.