Open-source maintainers and small security teams are drowning in AI-generated bug bounty reports. curl killed its bounty program over it. HackerOne says 60–80% of submissions across its platform are invalid. TriageShield checks the report's actual claims — file paths, line numbers, function names — against your repository's real, current code, and tells you exactly which ones don't hold up. No LLM vibes. Just: does this file exist, is this line inside the file, does this function exist.
Unlimited checks on public repos, right here on this page. No signup.
API access for private repos, batch checking, and a GitHub Action that auto-comments on every new
issue labeled security. For maintainers and small security teams who want this wired
into their inbox, not a webpage.
Team plan is early access — the checkout form asks which repo you want it wired to, and we'll follow up once the API/GitHub Action is provisioned for your account.
Catches: reports that cite a file that doesn't exist in the repo, a line number past the end of the file, or a function name that appears nowhere in the referenced file. This is the single most common tell in mass-produced AI-generated reports, because the model is pattern-matching a plausible-sounding CVE writeup, not reading your actual code.
Doesn't catch: a well-written fabrication with no concrete pointers, or a real vulnerability
described vaguely. Vague reports are flagged as NO_CONCRETE_CLAIMS so you know to read them
by hand — we don't pretend to have an opinion when there's nothing to check.
Why curl killed its bug bounty program — what happened, and why it's not a curl-specific problem.
How to tell if a vulnerability report is AI-generated — five checks that take under a minute each.