---
name: security-review-start-here
description: "Start here for an authorized security review or bug hunt on your own web app, API, smart contract, mobile app, device, cloud setup, build pipeline or AI app: picks which Bug Bounty Library skills fit the target and gives the find, confirm and report loop."
---
# Security review: start here

The Bug Bounty Library skills are built from 10,272 real, accepted security reports: paid bug bounties, judged audit findings, real-world hacks and published research. Each skill is a set of patterns: how a weakness works, where it shows up, how to check for it, and how the people who found it noticed it.

Use them only on systems you own or are allowed to test: your own code, a bug bounty program inside its published scope, or an engagement you were hired for.

## 1. Pick the skills for the target

| Target | Load these skills |
| --- | --- |
| A website, web app or API | `web-access-control`, `web-authentication-and-account-takeover`, `web-injection-and-code-execution`, `web-infrastructure-and-server-side`, `web-business-logic`, `web-authorization-workflows`, `web-auth-session-review`, `web-parser-boundaries` |
| Smart contracts and DeFi protocols | `smart-contract-access-and-control-flow`, `defi-accounting-and-math`, `defi-oracles-liquidations-and-flash-loans`, `evm-state-transition-review`, `evm-vault-accounting`, `evm-proof-of-impact` |
| An Android or iOS app | `mobile-app-security`, `web-access-control`, `web-authentication-and-account-takeover` |
| Routers, VPNs, firewalls, cameras and other devices | `network-devices-and-iot`, `web-injection-and-code-execution`, `memory-corruption-and-native-code` |
| Native code: C/C++ programs, browsers, kernels, parsers | `memory-corruption-and-native-code`, `web-parser-boundaries` |
| Cloud accounts, containers and Kubernetes | `cloud-and-container-security`, `web-infrastructure-and-server-side` |
| Build pipelines, dependencies and packages | `supply-chain-and-ci-cd` |
| Apps and agents built on AI models | `ai-and-llm-app-security`, `web-access-control` |

Before reporting anything, use `fp-check` to rule out false positives.

## 2. Follow the loop

1. **Scope.** Write down what you may test and what is off limits. Stay inside it.
2. **Map.** List every way in: pages, API routes, contract functions, exported app components, admin panels, build steps. Note who is meant to be allowed to do what.
3. **Hunt by pattern.** Open the matching skill and go through its patterns against that map. Open a pattern's file only when its "where it shows up" signs match what you see.
4. **Confirm.** Turn each suspicion into the smallest proof that shows the problem, using your own test accounts, test funds or a local copy. Never touch real users' data or money.
5. **Rule out false positives.** Drop anything you cannot confirm.
6. **Write it up.** Root cause, exact steps to reproduce, impact, and the fix. Name the pattern it matched.

## 3. Tips for smaller models

- Load one skill at a time, and keep a short checklist per way in: pattern checked, result.
- Read the code and configuration rather than guessing; quote the line that proves each finding.
- A pattern's evidence links (E1, E2, ...) open the real reports it was built from; read one when a pattern is unclear.

## Keeping the skills current

Skills are rewritten every few minutes as new reports arrive. Check https://bugbountylibrary.com/skills/manifest.json once a day; when its "version" differs from the .bugbountylibrary.json you installed, install again (see https://bugbountylibrary.com/skills/index.md).