Bug Bounty Hunter Demonstrates Claude Code Workflow for Finding Vulnerabilities

Summary

Bug bounty hunter Douglas, known as Archangel, demonstrates how he uses Claude Code skills built from past reports to test applications, and discusses prioritization, verification and the risks of automated testing.

Key points

• Douglas says he earned between $40,000 and $50,000 at a live hacking event using Claude Code.
• He built vulnerability-specific skills from his HackerOne reports and uses a reusable agent file and program-specific memory to guide testing.
• He says the agent file requires iteration to prioritize demonstrable security impact and avoid overemphasizing low-impact or theoretical findings.
• The demonstration uses JavaScript bundle analysis and an authenticated request to explore an application within a vulnerability disclosure program.
• The speakers recommend using separate test accounts and limiting data changes to avoid unintended harm during authorization testing.
• Douglas describes an automated test that deleted his second test account, complicating reproduction until the program confirmed the vulnerability.
• For beginners without prior reports, he suggests using publicly disclosed, bounty-awarded vulnerability reports as source material for skills.