{
  "schema_version": "1.0",
  "last_updated": "2026-02-14",
  "targets": [
    {
      "program": "litellm",
      "platform": "huntr",
      "repo_url": "https://github.com/BerriAI/litellm",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/litellm",
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "ssrf",
        "auth",
        "injection",
        "rce",
        "idor"
      ],
      "notes": "SCANNED 2026-02-13. Well-secured. Only medium admin-gated findings. Skip."
    },
    {
      "program": "DB-GPT",
      "platform": "huntr",
      "repo_url": "https://github.com/eosphoros-ai/DB-GPT",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/DB-GPT",
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "sqli",
        "rce",
        "ssrf",
        "auth",
        "path-traversal"
      ],
      "notes": "SCANNED 2026-02-13. Found critical PDF RCE + high SQLi. Reports drafted."
    },
    {
      "program": "ComfyUI",
      "platform": "huntr",
      "repo_url": "https://github.com/comfyanonymous/ComfyUI",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/ComfyUI",
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "rce",
        "path-traversal",
        "ssrf",
        "auth",
        "deserialization"
      ],
      "notes": "Image gen workflow UI. Python. 509 files. Custom node/plugin system = code execution surface. Known CVEs: CVE-2025-6107 (attr manipulation), CVE-2026-22777 (security bypass RCE), CVE-2025-67303 (config manipulation). Active attack surface."
    },
    {
      "program": "stable-diffusion-webui",
      "platform": "huntr",
      "repo_url": "https://github.com/AUTOMATIC1111/stable-diffusion-webui",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/stable-diffusion-webui",
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "rce",
        "path-traversal",
        "ssrf",
        "command-injection",
        "deserialization"
      ],
      "notes": "Massive image gen web UI. Python. 213 files + extensions. Extension system, model loading, image processing, API endpoints. Under-researched on huntr."
    },
    {
      "program": "OpenUI",
      "platform": "huntr",
      "repo_url": "https://github.com/wandb/openui",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/openui",
      "language": "python,typescript",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "auth",
        "hardcoded-secrets",
        "ssrf",
        "xss",
        "injection",
        "idor"
      ],
      "notes": "CLONED 2026-02-14. Next: investigate LiteLLM integration, share endpoints, and iframe postMessage/HTML execution boundary."
    },
    {
      "program": "AutoGPT",
      "platform": "huntr",
      "repo_url": "https://github.com/Significant-Gravitas/AutoGPT",
      "clone_path": null,
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "rce",
        "command-injection",
        "ssrf",
        "path-traversal",
        "deserialization"
      ],
      "notes": "181k stars. Autonomous AI agent. LOWER COMPETITION on huntr. Focus: plugin system, tool execution, file ops, web scraping."
    },
    {
      "program": "LlamaIndex",
      "platform": "huntr",
      "repo_url": "https://github.com/run-llama/llama_index",
      "clone_path": null,
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "sqli",
        "code-execution",
        "injection",
        "deserialization"
      ],
      "notes": "46.9k stars. RAG/LLM framework. RECENT: CVE-2025-1793 critical SQLi. MEDIUM COMPETITION. Focus: vector store integrations, query engines, custom loaders."
    },
    {
      "program": "LangChain",
      "platform": "huntr",
      "repo_url": "https://github.com/langchain-ai/langchain",
      "clone_path": null,
      "language": "python",
      "bounty_min": 0,
      "bounty_max": 1500,
      "focus": [
        "serialization",
        "injection",
        "ssrf",
        "deserialization",
        "rce"
      ],
      "notes": "126k stars. Agent/LLM framework. HIGH COMPETITION but massive codebase. Focus: custom chains, tool integrations, memory stores."
    },
    {
      "program": "Vercel Open Source",
      "platform": "hackerone",
      "repo_url": "https://github.com/vercel-labs/agent-skills",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/agent-skills",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep (security-audit+owasp-top-ten): 0 findings. Next: manual review of any server endpoints and action runners."
    },
    {
      "program": "Vercel Open Source",
      "platform": "hackerone",
      "repo_url": "https://github.com/vercel/ai",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/ai",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 4 findings (GH Actions run-shell injection + child_process usage in codemod). Triage: verify workflow triggers and secret exposure; codemod likely non-issue."
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/chia-blockchain",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chia-blockchain",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Imported from bounty-targets-data (handle=chia_network, max_severity=critical). CLONED+SCANNED 2026-02-15. Semgrep: 11 (CI interpolation warnings + test-only pickle + unverified SSL context). Trufflehog: 81 PrivateKey hits, all in simulator SSL cert fixtures."
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/chia-blockchain-gui",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chia-blockchain-gui",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Imported from bounty-targets-data (handle=chia_network, max_severity=critical). CLONED+SCANNED 2026-02-15. Semgrep: 0. Trufflehog: 0."
    },
    {
      "program": "Internet Bug Bounty",
      "platform": "hackerone",
      "repo_url": "https://github.com/apache/airflow",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/airflow",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Imported from bounty-targets-data (handle=ibb, max_severity=critical)"
    },
    {
      "program": "Internet Bug Bounty",
      "platform": "hackerone",
      "repo_url": "https://github.com/rails",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/rails",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Imported from bounty-targets-data (handle=ibb, max_severity=critical)"
    },
    {
      "program": "Polygon Technology",
      "platform": "hackerone",
      "repo_url": "https://github.com/0xPolygon/proof-generation-api",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/proof-generation-api",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 1 (Dockerfile missing USER). Trufflehog: 0 secrets (no-verification)."
    },
    {
      "program": "Polygon Technology",
      "platform": "hackerone",
      "repo_url": "https://github.com/0xPolygon/auto-claim-service",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/auto-claim-service",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 1 (Dockerfile missing USER). Trufflehog: 0 secrets (no-verification)."
    },
    {
      "program": "Polygon Technology",
      "platform": "hackerone",
      "repo_url": "https://github.com/0xPolygon/chain-indexer-framework",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chain-indexer-framework",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 0. Trufflehog: 0 secrets (no-verification)."
    },
    {
      "program": "Polygon Technology",
      "platform": "hackerone",
      "repo_url": "https://github.com/0xPolygon/lxly.js",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/lxly.js",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 0. Trufflehog: 0 secrets (no-verification)."
    },
    {
      "program": "Polygon Technology",
      "platform": "hackerone",
      "repo_url": "https://github.com/0xPolygon/static",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/static",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "CLONED+SCANNED 2026-02-15. Semgrep: 8 (GitHub Actions run-shell injection pattern; Dockerfile missing USER; nginx header-redefinition warnings). Trufflehog: 0 secrets (no-verification)."
    },
    {
      "program": "Chainlink",
      "platform": "hackerone",
      "repo_url": "https://github.com/smartcontractkit/chainlink",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chainlink",
      "language": null,
      "bounty_min": null,
      "bounty_max": null,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Imported from bounty-targets-data (handle=chainlink, max_severity=critical)"
    },
    {
      "program": "Coinbase",
      "platform": "hackerone",
      "repo_url": "https://github.com/coinbase/cb-mpc",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/cb-mpc",
      "language": null,
      "bounty_min": 200,
      "bounty_max": 1000000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=coinbase, max=1000000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 57 (mostly Go unsafe blocks; 2 CI/vendor issues). Trufflehog: 2 false positives (vendored tests)."
    },
    {
      "program": "Shopify",
      "platform": "hackerone",
      "repo_url": "https://github.com/Shopify",
      "clone_path": null,
      "language": null,
      "bounty_min": 500,
      "bounty_max": 200000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=shopify, max=200000usd, crit_x1.0"
    },
    {
      "program": "Chainlink",
      "platform": "hackerone",
      "repo_url": "https://github.com/smartcontractkit/external-adapters-js",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/external-adapters-js",
      "language": null,
      "bounty_min": 100,
      "bounty_max": 100000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=chainlink, max=100000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 6 (GitHub Actions interpolation warnings; Dockerfiles missing USER). Trufflehog (filtered): 6 false positives (example creds/lockfile checksums)."
    },
    {
      "program": "TRON DAO",
      "platform": "hackerone",
      "repo_url": "https://github.com/tronprotocol/java-tron",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/java-tron",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 100000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=tron_dao, max=100000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 39 (mostly response.getWriter JSON output warnings; likely false positives; plus 2 Dockerfile missing USER). Trufflehog: 1 false positive (.git refs)."
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/cosmos/gaia",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/gaia",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 18 (mostly scripts/terraform findings; likely non-bounty). Trufflehog: Algolia key in docs config (appears public/search key)."
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/cosmos/iavl",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/iavl",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 7 (unsafe blocks + math/rand + 1 use-tls warning). Trufflehog: 0."
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/cosmos/ics23",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/ics23",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 0. Trufflehog: 1 false positive (.git refs)."
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/cosmos/ledger-cosmos",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/ledger-cosmos",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/iqlusioninc/crates",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/crates",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/iqlusioninc/tmkms",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/tmkms",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/iqlusioninc/yubihsm.rs",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/yubihsm.rs",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/skip-mev/go-fast-contracts",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/go-fast-contracts",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "Cosmos",
      "platform": "hackerone",
      "repo_url": "https://github.com/cosmos/evm",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/evm",
      "language": null,
      "bounty_min": 2000,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=cosmos, max=50000usd, crit_x1.0"
    },
    {
      "program": "MetaMask",
      "platform": "hackerone",
      "repo_url": "https://github.com/Web3Auth/web3auth-web",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/web3auth-web",
      "language": null,
      "bounty_min": 250,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=metamask, max=50000usd, crit_x1.0. CLONED+SCANNED 2026-02-15. Semgrep: 0. Trufflehog: 1 false positive (wallet registry URLs)."
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/chia_rs",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chia_rs",
      "language": null,
      "bounty_min": 250,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=chia_network, max=50000usd, crit_x1.0"
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/chiapos",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chiapos",
      "language": null,
      "bounty_min": 250,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=chia_network, max=50000usd, crit_x1.0"
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/chiavdf",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/chiavdf",
      "language": null,
      "bounty_min": 250,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=chia_network, max=50000usd, crit_x1.0"
    },
    {
      "program": "Chia Network",
      "platform": "hackerone",
      "repo_url": "https://github.com/Chia-Network/clvm_rs",
      "clone_path": "/Users/sebas/Code/bug-bounty/data/repos/clvm_rs",
      "language": null,
      "bounty_min": 250,
      "bounty_max": 50000,
      "focus": [
        "auth",
        "injection",
        "ssrf",
        "rce",
        "idor"
      ],
      "notes": "Top-paying program scrape (hackerone-network-top-paying.jsonl): handle=chia_network, max=50000usd, crit_x1.0"
    }
  ]
}