Bug bounty report review
Bounty Operator checks your bug report against the code and proof before you submit. Get one verdict, with the file and line behind it.
Built by Tradi3, Top Ranked on Immunefi: 77th on its all-time leaderboard on 10 October 2026.
Our bug with standards has one rule: the claim has to match the proof. Watch the film, then inspect the saved review.
Draft report
Example
function stake(uint256 amount) external {
if (amount == 0) revert ZeroAmount();
_updateGlobal();
balanceOf[msg.sender] += amount;
One decision, with the file and line behind it. The draft stays yours to rewrite.
Every decisive claim is backed by the supplied code and proof. File it.
The finding holds. The draft misstates its severity, impact, preconditions or fix.
The claimed impact is not demonstrated on the real path yet. One artefact is missing.
A known issue, an audit note, a branch or your own earlier report has the same root cause or the same fix.
The code contradicts the root cause, the behaviour is the design, or the rules exclude it.
Follow the saved example from the draft to the cited code and downloadable packet.
Working in a coding agent? Watch the MCP walkthrough.
Drop files or a folder here
Source and text files. 120 KB per file. 240 KB, 50 files and 20,000 lines in total.
Named from what you paste. The review cites it by this name.
Files are read at one exact commit, straight from GitHub to this tab.
A read-only token. It goes to api.github.com from this tab and is forgotten on reload.
Optional. Tell the review what to focus on. Left empty, it uses its standard request.
ConnectedOpenRouter key held in this tab.
Held in memory for this tab and sent with the review request. Never stored. Create a key
Eight stages on one finding, each reading the ones before it. The gates that end a report run first.
Two to four models review the same files at once. One of them then cross-examines the reviews against the source and keeps what the code proves.
Paste the prompt into a new chat with any model. It carries the method and your files, every line numbered.
The result view and the packet are built in this tab. Nothing is sent.
Operator includes US$2 in Bounty Operator API credit per paid month. Other model providers bill usage separately.
US$0
No card or email.
US$10per month
Everything in Free, plus:
Billed monthly. Cancel any time in the Stripe portal and keep access until the paid period ends. Full plan comparison · Terms
Choose a model from OpenRouter, Anthropic, OpenAI, Google Gemini, xAI, DeepSeek, Mistral, Groq, Infron, OrcaRouter or Bounty Operator, on your own API key.