What problem does it solve? Broad security sweeps flood you with findings, but most are unreachable from outside your trust boundary. This Skill narrows a repo-wide security scan down to only the vulnerabilities an external attacker can actually reach, so bug-bounty hunters and security engineers focus remediation effort where it matters. ## Core Features & Use Cases - Remote-Reachability Gate: Statically enumerates entry points (Python, JavaScript, TypeScript, Go, Lua, Solidity), confirms exposure and auth tier once up front, then keeps only findings with a full path from an external tier to the sink. - Three-Tier Auth Model: Tags findings as unauth-external, authenticated-any-user (the IDOR/BOLA tier), or privileged (escalation paths only), dropping local-only and same-trust-tier paths. - CVE Reachability Ranking: Consumes dependency CVE scans (osv-scanner, npm audit, or a same-session code-sec run) and ranks them by whether the vulnerable package sits on an externally reachable path. - Use Case: Before a bug-bounty pass on a web API, run the triage to get a report grouped by attack surface (e.g., POST /api/score (public, unauth)) with severity-ordered reachable findings and a trailing section annotating dropped local-only issues. ## Quick Start Run /bounty-hunter on this repository to show me which vulnerabilities are actually exploitable from outside.
