Report in, verified block out, in one loop

A report lands in the desk's inbox (in this demo, seeded reports; an email/form intake is next). It's scope-checked against the program and deduplicated by root cause against case history.

Claude scores the report against a rubric. A beg-bounty with no reproducible payload (“missing DMARC, pay me $300”) gets $0 and a polite written reason. This is the only place the raw report is read for a decision.

A Cloudflare Sandbox clones the app at the production commit and replays the recorded request against the copy — never production. Egress is dropped (enableInternet=false). Evidence is recorded.

Claude reads only the sandbox's sterile stdout — never the report — and writes a narrow WAF rule. A readiness gate replays recorded legitimate traffic: one false positive is a NO-GO. Critical severity needs a phone approval.

The recorded request is re-run against the shielded edge and must return 403. If it doesn't, the shield rolls back and the case escalates.

Claude drafts the source fix and a regression test. No pull request is opened: a human reviews the draft and opens it.

A fixed proven-bug bounty under a ScopePass grant that can only narrow (pool → class → per-case cap). The company pays bounty + a 20% fee in one Stripe TEST charge; until the Stripe sandbox has Connect on, that charge is SIMULATED and labelled. A failed charge never reads as paid. A signed receipt goes on the ledger.

A Linear issue (real when the desk runs live), plus a Slack thread and a researcher email (simulated in this demo). Brainbase scores every case behind a local quality gate.

KEV trigger

While the desk is open it polls CISA's KEV catalog every 60 seconds (a conditional request, so most polls are a 304; CISA's GitHub mirror if cisa.gov doesn't answer). A new entry opens a case, an edit to an entry is recorded, and a replay of a real entry is labelled REPLAY.

Inventory + OSV

The entry is matched to what the owner runs (their lockfile), then OSV says whether that exact version is affected. Not affected closes the case; an unknown answer is never treated as safe.

Reachability

Two factors. Semgrep CE rules find server functions that are defined AND invoked from a route (file and line). Four anonymous test requests per route (no cookie, a forged session, a garbage cookie, a header-less form post), each with a marker body and no payload, check whether the edge lets them through. Semgrep is evidence, not proof (it reads one file at a time), so when neither finds a path the case is UNKNOWN, never "safe".

Drastic action

If ransomware crews use the flaw, the agent may ask to take the app offline. The credential policy refuses (DENY wins) and the owner decides on their phone (a simulated phone handoff today).

Pick a control

The agent names ONE control ID from a pre-approved catalog; it never writes rule logic. A deterministic gate refuses anything irreversible, drastic, or touching a route signed-in customers need.

Apply + verify

The control goes on at the edge. Verified means the control is enforced (the test request is blocked; that is not proof every exploit variant is blocked) AND a scripted customer journey (sign in → send an invoice) still works. If the journey breaks, Bountyloop reverts by itself and tries the next one.

Compromise check

CISA's entry asks owners to look for signs of compromise. Bountyloop reads the edge log and lists the owner's checks; it doesn't scan hosts.

Watch → retire

When a patched version is reported and OSV's re-check no longer lists the flaw, the control is removed and the journey re-run. The case file records the response time, the control, the evidence and the retirement; its signature covers a summary and a digest of the evidence.