BugHunter AI

Inspiration

The idea for BugHunter AI came while I was exploring bug bounty platforms like HackerOne and learning how security researchers discover vulnerabilities in web applications. I realized that while scanners can detect issues, many developers struggle to understand the results or know what to fix first. Reports are often highly technical, making them difficult for students, independent developers, and small teams.

During OpenAI Build Week, I wanted to build something that combined deterministic security scanning with GPT-5.6 to create an AI-powered application security engineer. Instead of replacing traditional scanners, the goal was to help developers understand verified findings, prioritize risks, and receive actionable remediation guidance based on evidence rather than assumptions.

What it does

BugHunter AI is an AI-powered application security engineer that performs authorization-aware security assessments.

The user describes a target application, and the AI first creates a scan plan while asking for authorization before any active testing begins. Deterministic scanners then collect security evidence such as security headers, exposed endpoints, reflected input, and common vulnerability indicators. GPT-5.6 analyzes only this verified evidence to generate structured findings, explain security risks, prioritize vulnerabilities, and recommend developer-ready remediation steps.

The project also includes a deterministic demo mode so users can experience the workflow without scanning a real application.

How we built it

BugHunter AI was built using React for the frontend and Node.js with Express for the backend. We integrated the OpenAI Responses API with GPT-5.6, using function calling and Structured Outputs to build a reliable AI workflow.

The security scanners remain deterministic and act as the source of truth. GPT-5.6 is responsible for planning assessments, selecting tools, correlating evidence, normalizing findings, and generating structured security reports. Throughout development, Codex was used extensively to accelerate implementation, debugging, testing, schema validation, documentation, and deployment.

The application is deployed using Vercel for the frontend and Render for the backend.

Challenges we ran into

The biggest challenge was integrating the OpenAI Responses API while complying with strict Structured Output requirements. We encountered JSON Schema validation issues, function-calling compatibility problems, deployment configuration across Vercel and Render, environment variable management, and API quota limitations.

Another challenge was designing a workflow where AI enhances deterministic security scanners instead of replacing them. We wanted every AI-generated conclusion to be supported by collected evidence rather than relying solely on language model reasoning.

Accomplishments that we're proud of Built an evidence-first AI security workflow instead of a simple chatbot. Successfully integrated GPT-5.6 using the OpenAI Responses API with Structured Outputs. Created authorization-aware scan planning before active testing. Designed deterministic demo mode for reliable demonstrations. Built a complete deployment pipeline using Vercel and Render. Produced developer-friendly remediation reports grounded in verified evidence. Learned and implemented production-grade schema validation and AI orchestration. What we learned

This project taught us that building AI applications involves much more than writing prompts. We learned how to design reliable AI workflows, integrate function calling, validate strict JSON schemas, deploy production applications, and combine traditional software engineering with AI reasoning.

Most importantly, we learned that AI is most valuable when it explains verified evidence instead of generating unsupported conclusions.

What's next for BugHunter AI

We plan to expand BugHunter AI into a more comprehensive application security platform by adding CI/CD integration, GitHub pull request security reviews, historical scan comparisons, compliance reporting, team collaboration, and IDE integrations. We also want to improve AI-assisted remediation guidance while continuing to keep deterministic evidence at the center of every security recommendation.

Our long-term vision is to make application security more understandable and accessible for developers without compromising accuracy or responsible security practices.

Built With

• ai
• api
• application
• cheerio
• express.js
• function
• git
• github
• gpt-5.6
• javascript
• jest
• library
• node.js
• npm
• openai
• react
• render
• responses
• rest
• security
• testing
• vercel