bug-reaper/
├── SKILL.md                     # Agent trigger + 4-phase workflow
├── references/
│   ├── recon.md                 # 7-phase recon methodology
│   ├── audit-rules.md           # Strict evidence requirements
│   ├── exploit-validation.md    # Input → sink tracing
│   ├── false-positive-elimination.md  # Adversarial FP checklist
│   ├── severity-guide.md        # CVSS scoring + platform tier map
│   ├── waf-bypass.md            # 15 WAF products, 10 bypass techniques
│   ├── chaining.md              # 8 chain templates (P3 → P1 escalation)
│   ├── platforms/               # HackerOne · Bugcrowd · Intigriti · YesWeHack
│   └── vulnerabilities/         # 18 hunting methodology files
└── scripts/
    ├── analyze_scope.py         # Parse program scope → structured JSON
    └── generate_report.py       # Generate platform-specific Markdown reports

/install bug-reaper

# From your project root
git clone https://github.com/shaniidev/bug-reaper .cursor/skills/bug-reaper     # Cursor
git clone https://github.com/shaniidev/bug-reaper .claude/skills/bug-reaper     # Claude Code
git clone https://github.com/shaniidev/bug-reaper .agents/skills/bug-reaper     # Antigravity

python scripts/analyze_scope.py hackerone_program.md --output scope.json

python scripts/generate_report.py \
  --platform hackerone \
  --vuln-type idor \
  --input finding.json \
  --output report.md

Title: IDOR on Order History — Any User's Orders Accessible
Severity: High
Confidence: Confirmed
Attack Prerequisites: Authenticated user (any account)
Vulnerable Endpoint: GET /api/v2/orders/{order_id}
Attack Path:
  1. Authenticate as User A, place an order → note order_id
  2. Authenticate as User B
  3. Request GET /api/v2/orders/<User_A_order_id>
  4. Full order details returned — items, address, payment summary
Why This Is Exploitable: No ownership check on the orders endpoint. The
  backend retrieves the order by ID alone with no session validation.
Realistic Impact: Any authenticated user reads another user's full order
  history including shipping address and last 4 card digits.
PoC Request:
  GET /api/v2/orders/10482 HTTP/1.1
  Authorization: Bearer <User_B_token>
Suggested Verification: Run the above request. Confirm order 10482 belongs
  to a different account than the token.
Recommended Fix: Validate req.user.id === order.userId before returning.