BountyAtlasautonomous security research
GitHub ↗
about

What this archive is

Bounty Atlas is the Phase 1 research foundation for an autonomous bug-bounty and vulnerability-discovery agent. It indexes the methodology, papers, tooling and real-world patterns an agent needs to reason about security testing — and it is published as a site so the research can be searched instead of grepped.

1,216sources across 401 hosts
19research collections
15downloaded papers
36reference repositories

What's inside

  • 1,216 catalogued sources — repositories, papers, tools, standards, books and articles, each with its collection and the description recorded during research.
  • 19 collections — the deep-research batches that produced the catalogue, from cloud IAM to LLM security.
  • 15 papers — full copies stored in repertoire/01_papers/ and served from this site.
  • 36 repositories — working trees are gitignored; the manifest records the URL and star count so any of them can be re-cloned.
  • Taxonomy — OWASP Top 10 (2021 and 2025 changes), API Top 10, 22 additional vulnerability classes and 149 tools in 20 categories.
  • Agent blueprint — 8 architecture insights traced to their sources.

How it was built

The archive was assembled through three research expansions, using deep-research workflows rather than a single search pass. Findings were cross-checked against the original papers and repositories; anything that could not be verified was dropped or annotated in place. The site itself is generated from the archive by two scripts:

  • scripts/build_data.py parses the source TSV, paper index, repository manifest and context document into JSON.
  • scripts/build_site.py renders the pages, copies the papers and emits the library dataset, sitemap and robots file.

Counts and descriptions on every page come from those files. If a number changes here, it changed in the archive — no copy is hand-maintained.

Responsible use

This archive is for authorised security research, education and defensive engineering. Nothing in it grants permission to test a system. Always obtain written authorisation from the system owner, respect the scope and rules of engagement, and stop when a test could affect availability or third-party data.

The repository intentionally contains no exploit code or active attack tooling: it contains links, metadata, papers and methodology. Reference repositories are read-only; the archive does not vouch for their safety and they must be audited before use.

License

The site generator, templates and original text in this repository are released under the MIT License (see LICENSE). Linked third-party resources, papers and repositories remain the property of their authors and are governed by their own licenses. Paper copies are stored for research access; follow the original source for reuse terms.

Contributing

Sources can be proposed by editing repertoire/_new_sources_full.tsv (five tab-separated columns: collection id, collection header, title, URL, description) and re-running the two build scripts. See CONTRIBUTING.md for the validation checks. Broken links and mis-categorised entries are welcome as issues.

Project links

Archive status

complete

1. Research & curation

This archive: sources, papers, repositories and taxonomies.

planned

3. Agent implementation

Recon, analysis, validation and reporting stages with deterministic guardrails.

planned

4. Testing & iteration

Benchmarks against known targets, ablation studies and regression suites.

Provenance

Every page is generated from the files in repertoire/. The deployed site was built from revision v2.0.0.

981 annotated sources4 anchor papers

Scope of the index

Web, APIs, cloud, containers, mobile, wireless, Web3, binaries, supply chain, LLM systems and agent security. Sources are catalogued, not endorsed.