Bouncer checks every bug report against the real code, before a maintainer has to read it.
One click runs 10 sample reports. Proven bugs sort to the top, fakes to the bottom, each with its verdict.
T04 is fabricated: the file, function and quoted code exist in no release. Each finding shows the git command that proves it.
T01 is real: rebuilt with AddressSanitizer in a sandbox with no network, a read-only root and no secrets. Crashed 3 of 3 times.
Nemotron 3 Super's fix passed all four checks: crash gone, all tests pass, 2-line diff, new test fails on the old code.

Inspiration

AI made convincing fake security reports free to write. Disproving one still costs a volunteer maintainer about an hour. In January 2026 curl ended its bug bounty to "remove the incentive for people to submit crap and non-well researched reports" (The Register). In April, HackerOne paused the Internet Bug Bounty, citing AI-generated reports overwhelming the projects that receive them (Privacy Guides). Finding bugs is no longer the bottleneck. Verifying them is.

What it does

Bouncer verifies every report before a human reads it:

Extracts the concrete claims (Nemotron 3 Nano). Anything the model extracts that is not in the report word for word is dropped.
Checks them against the real repository with git, across every release and the full history.
Checks whether cited CVEs were ever issued (CVE Program API) and whether the bug was already reported.
Builds the claimed version with sanitizers in a network-less, read-only, non-root sandbox and runs the reporter's own steps three times.
Computes the verdict with code rules over that evidence. Nemotron only explains it.

For reproduced bugs, a patch loop drafts a fix. Ultra writes the root cause, Super writes the patch and a regression test, and Nano summarises failed attempts. A fix is kept only if:

the crash is gone;
all tests pass;
the diff is small;
it passes an anti-cheat scan;
the new regression test fails on the old code.

The fix goes into a draft private GitHub security advisory, never a public PR.

How we built it

Backend: FastAPI with a five-stage async pipeline, SQLite, and server-sent events for the live queue.
Models: every call goes through one gateway to Nebius Token Factory. Output must be schema-validated JSON and is retried if malformed. Each call logs model, tokens, latency and cost, shown on each card. A daily budget cap stops spending.
Sandbox: a Docker container with --network none, a read-only root, uid 10001, all capabilities dropped, and memory/CPU/pids limits. It holds no secrets.
Dashboard: Next.js 16 and Tailwind 4.
Tests: 28 pytest tests, including an end-to-end run of 10 designed reports through the real sandbox.

How it uses Nemotron and Nebius

Each tier does the job it is sized for:

Model	Jobs
Nano	Runs on every report: claim extraction, duplicate comparison, failure summaries
Super	Coding work: reproduction scripts, patches and regression tests
Ultra	Reasoning-heavy work: root cause from the sanitizer log and the code, plus judgement-call explanations

All of it runs on Nebius Token Factory. There is no other model provider.

What makes it different

Verdicts come from evidence, not "AI detection". Each check shows the command that proves it.
"Fabricated" needs a hard, checkable falsehood. Mixed evidence becomes "Needs human".
Model output can drop a claim but never invent one.
It never auto-closes a report, never auto-merges a fix, and never publishes a security fix.

Closest existing tools

HackerOne Hai Triage: a paid AI agent working alongside human analysts on a bug-bounty platform. It rates new reports as likely valid, invalid or needs review, and can close duplicates and spam (docs). Bouncer is open source and runs on the maintainer's own repo. It checks claims against the code and reproduces the PoC instead of judging the text, and code rules decide the verdict, not a model.
Google DeepMind CodeMender: an agent that finds and patches vulnerabilities in open-source projects (The Hacker News). Bouncer starts from an inbound human report and only patches what it has reproduced.
Trail of Bits Buttercup (AIxCC): an open-source system that fuzzes with sanitizers and patches what it finds (blog). Bouncer validates third-party claims, including git grounding and CVE checks, instead of hunting for new bugs, and it never generates exploits.

We found no open-source tool that combines claim grounding, CVE checks, sandbox reproduction and verified patching for inbound reports.

Challenges we ran into

Making "Fabricated" safe: a single false detail next to a working PoC must not get a real bug thrown out. That is why mixed evidence always goes to a human.
Stopping the patch model from "cheating", for example by special-casing the repro input, disabling the function or editing the tests. The anti-cheat scan and the "regression test must fail on old code" check handle this.
Nebius Serverless Jobs has no network-off option, so the sandbox runs as a locked-down Docker container with --network none. docs/DEPLOY.md covers running it on a Nebius VM.

Accomplishments we're proud of

All 10 designed reports, including a prompt-injection attempt, get the expected verdict, and the queue order is asserted in tests.
Fabricated reports are stamped before any sandbox starts, so cheap checks absorb the spam.
The patch loop rejects the cheating attempt and passes the real fix with every check green.

What we learned

For trust, the model should explain the decision, not make it.
Exact-match grounding of quoted code catches a surprising share of invented reports on its own.

What's next

A per-project build recipe (bouncer.toml) so any C or Python repo can use it.
A GitHub App for intake from issues and private vulnerability reports.
A larger evaluation on real, public slop reports.

Limitations

Languages: the first version supports C (built with sanitizers) and pure Python projects. Other languages fall back to claim checking only, with no reproduction. (This build: the Python path is claim checking only.)
Complex setups: bugs that need a live server, special hardware, a particular OS or a large dataset cannot be reproduced in the sandbox. They get Needs human, never Fabricated.
Not reproduced is not "false": some real bugs only trigger rarely or under timing conditions. Bouncer says what it tried, and does not call the report fake.
Fix quality: a patch that passes all four checks can still be wrong in ways the tests do not cover. It is a draft for review, never a merge.
Logic and design flaws: vulnerabilities with no crash (for example, an authorization mistake) are hard to verify automatically. Bouncer can ground the claims, but not prove them.
Duplicate detection relies on search and the model's comparison, and can miss rewritten duplicates.
Cost: every reproduction uses CPU compute for the sandbox, and model spending is capped by a configurable daily budget (BOUNCER_DAILY_BUDGET_USD).
Evaluation size: results in the demo come from 10 designed reports, not a large benchmark.