Apppublic

war1234/bug-bounty-hunter

sourceHugging Faceupdated 6mo agoView on Hugging Face

0likes

App README

🔍 Bug Bounty Hunter — OpenEnv

An RL environment where AI agents learn to act as security researchers.

The agent receives production-style vulnerable Python code and must:

1.Identify the vulnerability type (SQLi, IDOR, Insecure Deserialization...)
2.Classify severity (Low / Medium / High / Critical)
3.Write a fix for the vulnerable code
4.Explain the issue to a non-technical stakeholder

API Endpoints

Method	Path	Description
`GET`	`/health`	Liveness ping
`POST`	`/reset`	Start new episode
`POST`	`/step`	Submit action → get reward
`GET`	`/state`	Episode metadata
`GET`	`/tasks`	List all 3 challenges

Quick Start (Python)

python

import requests

BASE = "https://Daksh-agarwal-bug-bounty-hunter.hf.space"
# Start episode
obs = requests.post(f"{BASE}/reset").json()["observation"]
print(obs["code_snippet"])

# Submit answer
action = {
    "vuln_type": "sql_injection",
    "severity": "critical",
    "fixed_code": "cursor.execute('SELECT * FROM users WHERE username = ?', (username,))",
    "explanation": "SQL injection via parameterized queries..."
}
result = requests.post(f"{BASE}/step", json=action).json()
print(f"Reward: {result['reward']}")

Reward Function

reward = 0.35 × vuln_identified
       + 0.25 × severity_correct
       + 0.30 × fix_quality
       + 0.10 × explanation_quality

Range: [0.0, 1.0] — partial credit at every dimension.

Challenges

#	Difficulty	Vulnerability
0	🟢 Easy	SQL Injection
1	🟡 Medium	IDOR / Broken Access Control
2	🔴 Hard	Insecure Deserialization + Command Injection

Setup & Run Locally

Prerequisites

—Python 3.10+
—Docker Desktop

Option 1 — Run with Docker

bash

git clone https://github.com/Dakshh-Agarwal/bug-bounty-hunter.git
cd bug-bounty-hunter
docker build -t bug-bounty-hunter .
docker run -p 7860:7860 bug-bounty-hunter

Visit http://localhost:7860/docs to explore the API.

Option 2 — Run without Docker

bash

pip install -r server/requirements.txt
uvicorn bug_bounty_env.server.app:app --host 0.0.0.0 --port 7860

Run the Inference Agent

bash

pip install openai requests

export API_BASE_URL=https://api-inference.huggingface.co/v1
export MODEL_NAME=meta-llama/Llama-3.1-8B-Instruct
export HF_TOKEN=hf_your_token_here
export ENV_URL=https://Daksh-agarwal-bug-bounty-hunter.hf.space

python inference.py