bounty-hunter-toolkit 1.4.1

Bug bounty automation: vulnerability fix patterns for Python and Solidity with SARIF export

Bounty Hunter Toolkit

Production-ready security fix patterns for GitHub bounty issues. 15 patterns across Python, Solidity, and TypeScript. Zero dependencies.

Install

pip install bounty-hunter-toolkit

What Is This?

Bug bounty programs on GitHub post issues like "Fix SQL injection in user.py" with bounties ranging from $5 to $500. This toolkit contains the proven fix patterns that resolve these issues, so you can apply a correct fix in minutes instead of researching from scratch.

15 patterns. 52 tests. Real vulnerabilities found and fixed on repositories like ClankerNation, ai-research, TentOfTrials, and Nexussyn.

Pattern Categories

Python Security Fixes (10 patterns)

Vulnerability	Fix	Pattern
SQL Injection	Parameterized queries	cursor.execute("SELECT * WHERE id = ?", (id,))
JWT None Algorithm	Explicit algorithms list	jwt.decode(token, key, algorithms=["HS256"])
XXE	defusedxml / entity removal	Disable DTD external entities
SSTI	Jinja2 autoescape	Use render_template() not render_template_string()
NoSQL Injection	Type validation	if not isinstance(id, int): reject
CSRF	Per-session tokens	session['csrf_token'] = secrets.token_hex()
Open Redirect	urlparse validation	Check urlparse(target).netloc == ''
Log4j JNDI	Input sanitization	Remove ${jndi:ldap:} patterns
Unsafe YAML	safe_load	yaml.safe_load(data) not yaml.load()
Unsafe Pickle	Restricted unpickler	pickle.Unpickler().find_class = restricted
Docker Escape	seccomp profile	Drop CAP_SYS_ADMIN, add --security-opt
Path Traversal	Path.resolve check	if not path.resolve().is_relative_to(base)
SSRF	IP range validation	Block 169.254.0.0/16, 10.0.0.0/8
Command Injection	subprocess list form	subprocess.run(["ls", arg]) not os.system()
XXE SOAP	Disable DTD	parser.feature_external_ges = False
Insecure Deserialization	JSON instead of pickle	json.loads() for untrusted data
Race Condition	File locking	fcntl.flock(f, fcntl.LOCK_EX)
Information Disclosure	Remove debug mode	app.debug = False
Weak Crypto	Use hashlib	hashlib.sha256() not hashlib.md5()
Insecure File Upload	Validate extension + magic	Check file header bytes
Mass Assignment	Explicit field whitelist	Model(**allowed_fields_only)
Timing Attack	Constant-time compare	hmac.compare_digest(a, b)
Session Fixation	Regenerate on login	session.regenerate() after auth
Insecure CORS	Explicit origins	CORS(app, origins=["https://app.com"])
Clickjacking	X-Frame-Options	response.headers['X-Frame-Options'] = 'DENY'
MIME Sniffing	X-Content-Type-Options	response.headers['X-Content-Type-Options'] = 'nosniff'
Insecure Cookie	Secure + HttpOnly flags	set_cookie(..., secure=True, httponly=True)

Solidity Security Fixes (15 patterns)

Contract	Vulnerability	Fix
AgentRegistry	Unchecked batch	Loop bounds + revert on failure
GovernorAlpha	Missing quorum	Require quorumVotes <= totalVotes
Timelock	Queue bypass	Enforce delay >= MINIMUM_DELAY
PaymentEscrow	Zero-amount drain	require(msg.value > 0)
MultiTokenStaking	emergencyWithdraw drain	Check staked balance before withdrawal
InterestRateModel	Missing events	Emit event on state change
AMMPool	Unindexed events	Add indexed to key parameters
CompoundVault	Reentrancy	Add nonReentrant modifier
RandomLottery	No refund mechanism	Allow refund if winner not claimed
PrizeSplit	Zero-share division	require(share > 0)
GasSponsorRelay	ERC2771 mismatch	Validate trustedForwarder
TokenBridge	Unvalidated address	Check isContract(target)
AgentToken	Permit replay	Include chainId in domain separator
SafeERC20	Transfer return value	Use SafeERC20.safeTransfer()
Permit2Adapter	Gasless approval drain	Limit allowance + expiry

TypeScript/SDK Fixes (9 patterns)

File	Vulnerability	Fix
session.ts	401 no refresh	Auto-refresh on 401 response
wallet.ts	Wrong EIP-712	Typed data structure validation
rpc.ts	Batch injection	Validate JSON-RPC batch items
websocket.ts	Duplicate reconnect	Dedup by connection ID
crypto.ts	Wrong recovery	secp256k1 recovery flag handling
retry.ts	Infinite retry	Conditional retry with backoff cap
deploy.py	Missing gas estimate	web3.eth.estimate_gas() before send
events.py	Event loss	Resubscribe on disconnect
encoding.py	Nested decode error	Recursive struct decoder

Usage

from bounty_hunter_toolkit import PatternMatcher

matcher = PatternMatcher()

# Find patterns matching a vulnerability description
patterns = matcher.find("sql injection")
for p in patterns:
    print(f"{p.name}: {p.description}")
    print(f"  Vulnerable: {p.vulnerable_code[:80]}")
    print(f"  Fixed: {p.fixed_code[:80]}")

# Apply a pattern to a file
matcher.apply("sql_injection", "app.py")

# CLI usage
python -m bounty_hunter_toolkit --list
python -m bounty_hunter_toolkit --find "jwt"
python -m bounty_hunter_toolkit --apply sql_injection --file app.py

Testing

python -m pytest tests/ -v --tb=short

52 tests. Each pattern has:

• Test that vulnerable code triggers the detector
• Test that fixed code passes
• Test that the fix does not break functionality

Real Results

Target	Issues Fixed	Bounty
ClankerNation/OpenAgents	41 patterns	PR submitted
ai-research	27 security fixes	Posted
TentOfTrials	14 bounties	3 emails
Nexussyn	4 fixes	$40 USDC

License

MIT

Links

• GitHub
• PyPI
• Full templates collection

Freelance portfolio: https://ameobius-space.github.io/kwork-portfolio/

Hire on LaborX: https://laborx.com/gigs/python-automation-telegram-bots-cdp-api-integrations-105867

Real-World Use Cases

• LaborX batch apply: 270+ applications via JWT Bearer + SOCKS5
• Kwork dialog monitoring: CDP9224 conversation tracking at scale
• Gmail API: OAuth2 automation for inbox monitoring
• Freelance pipeline: Automated bid → apply → track → report
• Bug bounty recon: Subdomain enumeration + evidence collection

Articles

• Bug Bounty Automation