# AI-assisted bug bounty work: keep scope, execution and evidence under researcher control

Source: https://www.web3sec.news/blog/ai-assisted-bug-bounty-workflow
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Record current assets, prohibited techniques and program reporting rules.
- [ ] Constrain targets and rate limits outside retrieved content.
- [ ] Review generated code and reproduce hypotheses locally first.
- [ ] Use controlled accounts and stop after minimal sufficient evidence.
- [ ] Redact and independently reproduce the final report before submission.

## References
- [HackerOne: safe harbor overview and scope distinction](https://docs.hackerone.com/en/articles/8494502-safe-harbor-overview-faq)
- [HackerOne: submitting reproducible vulnerability reports](https://docs.hackerone.com/en/articles/8473994-submitting-reports)
- [Bugcrowd: researcher code of conduct](https://www.bugcrowd.com/resources/hacker-resources/code-of-conduct/)