01 · Work · bbctl
bbctl is a command line tool I built to run my authorized work from end to end. It organizes , keeps track of what has been checked, and turns findings into a clean report.
It is a personal tool for my own Bugcrowd engagements. Everything runs through one scope-checked gateway, and nothing is ever submitted without me.
02 · Story
Why I built it
What is in scope, what was checked, what is left, what to report. I wanted one tool that keeps all of it straight for my own authorized engagements.
Who stays in controlAuthorized programs only. One gateway enforces scope, and nothing is submitted without me.
03 · How it works
Subdomain search starts only from in-scope wildcards; exact hosts are checked directly and never expanded.
Every tool call passes one gateway that checks scope, the allowlist, the kill switch and the rate limit.
Findings are rated on Bugcrowd's public severity scale, and a noise gate marks scanner junk without deleting it.
Only findings I have verified become drafts with proof and repro steps. Drafts are saved, never sent; I press submit.
04 · Features
An out-of-scope match always wins, nothing runs without an in-scope match, and a target hiding a second host is refused.
Only tools named in a config file can run at all.
A per-program rate limit, half a request a second by default, kept on disk across restarts.
Every allowed run, every denial and every timeout is logged per program.
Credentials are removed from evidence before it is stored.
Daily and per-program limits on AI use; the pipeline itself costs nothing to run.
05 · Scenarios
A new authorized program
From the first command, the gateway refuses anything outside it.
An interrupted night
The run resumes from where it stopped, without redoing finished work and with the rate limit intact.
Report day
The noise gate trims scanner junk, I verify what is left, and a rated draft waits for my submit.
A self-audit
The audit log shows every request made and every one that was blocked.
I am not looking for work. I am looking for good people to know.