Bountyloop

Bountyloop turns security claims into executable proof: agents reproduce each report in a sealed sandbox, block it at the edge, and authorize a bounty only on signed proof.

Comment

The problem

Seed-stage SaaS companies have no security team, so the founding engineer owns the security@ inbox. It fills with real bugs, "beg bounties" (like $300 demanded for a missing DMARC record) and AI-written reports with made-up evidence. Paying on the text of a report pays for fakes; checking each one by hand costs hours of senior engineering time.

What I built

Bountyloop is an agent-run vulnerability-disclosure desk that turns each claim into executable proof. Don't triage claims. Verify exploits.

  1. Scope Guard reads the program's rules as code and refuses out-of-scope reports ($0, with a written reason).
  2. Root-cause dedupe catches resubmissions of the same bug ($0).
  3. Reproduce: the exploit is replayed 3 times in a Cloudflare Sandbox container with its internet cut off, against a copy of the app, never production.
  4. Shield: Claude writes a narrow tenant-ownership block. A Cloudflare Worker enforces it, and the exploit is re-sent 3 times to the live Worker: 403 every time, 0 of 3 return data. A WAF rule is staged for the owner's approval.
  5. Fix: Claude drafts the source fix and a regression test. Nothing merges without the owner.
  6. Evidence Gate: only when four measured checks pass (reproduced, controlled, in scope, not a duplicate) is the $250 bounty authorized, with an Ed25519-signed receipt and proof package.
  7. Verify API: any platform can check a proof. POST /api/verify {"proof_id": "..."} returns the signed record and confirms its signature.
  8. Pre-registered test on 60 seeded reports: text-only triage would have paid $5,000 across 20 false or duplicate payouts; requiring proof paid those $0 and missed 4 real bugs, which it names.

How I built it: tech stack and sponsor tools

  • Anthropic Claude (live): the slop gate, the block rule, the drafted fix and the refusal emails. The Claude step that writes the block only sees the sterile sandbox trace, never the reporter's text, as a structural defence against prompt injection.
  • Cloudflare: a Sandbox SDK container for reproduction with egress dropped; a Worker and Durable Object shield that enforces the block on a public demo app; a staged WAF rule.
  • Stripe (test mode): the funded test balance behind the bounty pool. The researcher payout (a Connect transfer) is simulated and labelled because Connect isn't enabled on the account yet; no money moves.
  • Brainbase: the pipeline also runs as a six-agent Brainbase orchestration (Intake → Scope → Reproduction → Evidence → FixVerification → Treasury, with typed handoffs), with a real thread run and a nightly regression schedule configured. In the demo, a local gate scores each case.
  • Next.js and TypeScript, Ed25519 signatures, Playwright, and Linear (an issue per resolved case). 37 behaviour tests. Every step in the UI is tagged LIVE, LOCAL or SIMULATED.

What I built today

  • The Evidence Gate with measured counts, the Scope Guard with program-as-code rules, and root-cause dedupe.
  • Signed proof packages and the Verify API, with proofs that persist across restarts so anyone can check them later.
  • Measured verification against the live Cloudflare Worker (replays before and after the shield); the shield stays on after a verified run.
  • The six-agent Brainbase orchestration with real runs.
  • The Sandbox reproduction deployed to Cloudflare's network (token-gated), and a public demo desk on Cloudflare Workers.
  • The decision band UI, honest LIVE / LOCAL / SIMULATED labels, and the demo video pipeline, whose cards are generated from saved API responses.

Try it yourself

  • Public demo desk (simulated mode, no keys): https://bountyloop-desk.agentglass.workers.dev. The live run is in the video and on stage.
  • Check the signed proof: curl -X POST https://bountyloop-desk.agentglass.workers.dev/api/verify -H 'content-type: application/json' -d '{"proof_id":"BL-A96074"}' returns the record with signature_valid: true.
  • See the live block. The demo app Bountyloop protects runs on Cloudflare, and the Worker block Bountyloop deployed is live on it:
curl -i -H "x-bl-tenant: acme" https://bountyloop-demo.agentglass.workers.dev/api/invoices/5510

Acme asking for Globex's invoice gets 403, with no invoice data. On stage the desk runs live: Claude calls, and reproduction in a Cloudflare Sandbox container on Cloudflare's network.

Two short story films

AI-generated with Google Omni (text-to-video); they show the idea, and the demo above shows the real run.

What's next

Turn on Stripe Connect so verified bounties pay out; apply and test the drafted fix inside the sandbox before authorizing (proof of fix, not just proof of block); stateful replay to close the four honest misses; a pilot with one seed-stage SaaS.

The core desk (intake, sandbox reproduction, edge shield, capped treasurer, receipts and the seeded test) was prepared before the event; everything under "What I built today" was built during it.

Built With

  • anthropic
  • brainbase
  • claude
  • cloudflare-sandbox
  • cloudflare-workers
  • durable-objects
  • ed25519
  • next.js
  • playwright
  • stripe
  • typescript
Share this project:

Updates

Submission history