Start here

Six steps, in the order most hunters need them. Each one points at the part of the library built for it.

1. Choose a program you are allowed to test

   Scope decides everything that follows. The program atlas lists 1,164 public programs across the major platforms, and 40 policies have been read in full and summarised. Scope changes shows which programs added or removed assets between snapshots. These records are dated observations. Read the live policy on the platform before you send a single request.

   • How the platforms differ
   • Where scope data is missing

2. Learn one bug class properly

   Depth in one class tends to pay off sooner than a shallow pass over many. Techniques by bug class has 43 briefs. Each brief states what proves the bug, then links the playbook, checklist and disclosed cases for that class. If you already have something in front of you, such as saved JavaScript or a second account, the decision guide tells you which brief to open.

   • 70 step-by-step playbooks
   • Checklists to work through on a target

3. Set up a small toolkit

   You need fewer tools than most lists suggest. The tool directory covers 108 tools with install commands and usage, and the command generator fills in a command or a pipeline for your target. Workflows chain several tools for common jobs.

   • Wordlists worth having
   • Encoders and parsers that run in your browser

4. Study how real findings were made

   The case library holds 67 disclosed findings that each earned at least USD 10,000. Every case gives the root cause, what was actually demonstrated, what to check for in other systems, and a link to the original writeup. Browse them by topic to see the same mistake repeated across vendors.

   • Shorter field reports from public disclosures
   • Diagrams of the trust boundaries involved

5. Validate before you report

   A report is often rejected for its evidence, not for the bug. Evidence-led validation covers what to capture, and Skeptical review is the pass that catches duplicates, out-of-scope hosts and impact you cannot show.

   • Why P1, High and CVSS 9.8 are not the same scale

6. Write it up and keep current

   Finding reporting covers the structure triagers expect. After that, the feed carries security news, new research writeups and scope changes in one list.

   • Give your AI agent the same library over MCP
   • Download everything as JSON

Already experienced?

Go straight to scope changes for fresh attack surface, the case library for recent high-award findings, or the MCP connector to query all of it from your own tooling.

Everything here is for testing systems you own or are explicitly authorised to test. See responsible testing.