Is this vulnerability report real, or AI slop?
Open-source maintainers and small security teams are drowning in AI-generated bug bounty reports. curl killed its bounty program over it. HackerOne says 60–80% of submissions across its platform are invalid. TriageShield checks the report's actual claims — file paths, line numbers, function names — against your repository's real, current code, and tells you exactly which ones don't hold up. No LLM vibes. Just: does this file exist, is this line inside the file, does this function exist.
Try it on a public repo
Pricing
Unlimited checks on public repos, right here on this page. No signup.
API access for private repos, batch checking, and a GitHub Action that auto-comments on every new
issue labeled security. For maintainers and small security teams who want this wired
into their inbox, not a webpage.
Team plan is early access — the checkout form asks which repo you want it wired to, and we'll follow up once the API/GitHub Action is provisioned for your account.
What this catches — and what it doesn't
Catches: reports that cite a file that doesn't exist in the repo, a line number past the end of the file, or a function name that appears nowhere in the referenced file. This is the single most common tell in mass-produced AI-generated reports, because the model is pattern-matching a plausible-sounding CVE writeup, not reading your actual code.
Doesn't catch: a well-written fabrication with no concrete pointers, or a real vulnerability
described vaguely. Vague reports are flagged as NO_CONCRETE_CLAIMS so you know to read them
by hand — we don't pretend to have an opinion when there's nothing to check.
Read more
Why curl killed its bug bounty program — what happened, and why it's not a curl-specific problem.
How to tell if a vulnerability report is AI-generated — five checks that take under a minute each.