Topics / #bug-bounty

Bug-bounty projects on GitHub

Resources and tools for hunting security bugs in bounty programs.

As of October 17, 2026, the most-starred Bug-bounty projects on GitHub are Awesome-Hacking (122.8K stars), strix (69.1K stars) and h4cker (29.8K stars). GitHub.Locker tracks 17 Bug-bounty repositories with 326.6K stars combined. The fastest-growing on October 16 was strix, with +214 stars in a day.

17Projects

326.6KStars in total

+429Stars in a day

Browse in the catalog →github.com/topics/bug-bounty ↗

Hot right now

Most stars gained in a day · Oct 16

+214

strix

usestrix/strix · ★ 69.1K

Strix is an open-source tool that uses autonomous AI agents to pentest your application like real hackers: it runs your code dynamically, finds vulnerabilities, and proves them with working exploits instead of just flagging suspicious patterns.

+104

Awesome-Hacking

Hack-with-Github/Awesome-Hacking · ★ 122.8K

A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

+21

Claude-Red

SnailSploit/Claude-Red · ★ 7.6K

claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.

+20

redamon

samugit83/redamon · ★ 3.1K

RedAmon is an open-source, self-hosted AI framework that chains reconnaissance, exploitation and post-exploitation into one pipeline, maps the attack surface into a Neo4j graph, and then triages findings and opens GitHub pull requests that fix what it discovers.

The all-time top

17 projects · by stars

#1 · Hack-with-Github/Awesome-Hacking
Awesome-Hacking
A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.
122.8K
#2 · usestrix/strix
strix
Strix is an open-source tool that uses autonomous AI agents to pentest your application like real hackers: it runs your code dynamically, finds vulnerabilities, and proves them with working exploits instead of just flagging suspicious patterns.
69.1K
#3 · The-Art-of-Hacking/h4cker
h4cker
A curated collection of thousands of cybersecurity resources — references, scripts, tools, code, labs, and training material — maintained by Omar Santos as a companion to his books, video courses, and live training.
29.8K

4
dirsearch
15Kmaurosoria/dirsearch · Python
Dirsearch is an advanced command-line web path brute-forcer used to discover hidden files and directories on websites for security testing.
5
hacker101
14.6KHacker0x01/hacker101 · SCSS
Hacker101 is a free online class for web and mobile security from HackerOne (the Hacker0x01 org), aimed at everyone from programmers curious about bug bounties to seasoned security professionals.
6
PENTESTING-BIBLE
14KblaCCkHatHacEEkr/PENTESTING-BIBLE
A curated catalog of over 200 numbered links to pentesting articles, bug bounty write-ups, cheat sheets and other security lists — a reading collection, not software.
7
Resources-for-Beginner-Bug-Bounty-Hunters
12.3Knahamsec/Resources-for-Beginner-Bug-Bounty-Hunters
A curated collection of resources for people getting started with web hacking and bug bounty hunting, including blog posts, talks, books, tools, labs and vulnerability-type guides.
8
magento2
12.2Kmagento/magento2 · PHP
Magento Open Source is a PHP eCommerce platform that provides the core capabilities needed to build an online store from the ground up.
9
bbot
10.7Kblacklanternsecurity/bbot · Python
BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.
10
Claude-Red
7.6KSnailSploit/Claude-Red · Python
claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.
11
Agentic-Bug-Hunter
5.4Kawarexone/Agentic-Bug-Hunter · Python
Agentic Bug Hunter is an AI-powered bug bounty toolkit that runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, or Immunefi, right from your terminal.
12
Claude-BugHunter
5.1Kelementalsouls/Claude-BugHunter · Python
A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.
13
redamon
3.1Ksamugit83/redamon · Python
RedAmon is an open-source, self-hosted AI framework that chains reconnaissance, exploitation and post-exploitation into one pipeline, maps the attack surface into a Neo4j graph, and then triages findings and opens GitHub pull requests that fix what it discovers.
14
Pentest-Swarm-AI
3KArmur-Ai/Pentest-Swarm-AI · Go
Pentest Swarm AI is an open-source, self-hosted penetration testing tool where dozens of AI agents work as a swarm to recon, classify, exploit, and report vulnerabilities in APIs and web apps — not just scan for them.
15
Cybermes
946Zyrexnn/Cybermes · Python
Cybermes is an offensive security assistant and automation framework for authorized bug bounty hunting, reconnaissance, vulnerability research, and structured reporting, driven by AI agents and a library of 200+ playbooks.
16
bug-bounty-hunting-prompts
612mdpsec/bug-bounty-hunting-prompts
A pack of reusable prompt files for running a structured, evidence-first bug bounty hunting workflow with an LLM agent, covering recon through triage and escalation.
17
pentest-harness
422S1N6H/pentest-harness · TypeScript
A self-hosted AI agent harness for authorized penetration tests, bug bounty research, security labs, and CTF engagements, where you bring your own AI model API key.