Haruto Kimura

TriageGuard is an autonomous validator for vulnerability reports. Drop in a report + PoC + claimed affected code; it returns a Signal-vs-Slop verdict with auditable reasoning, end to end and unattended. The bug bounty industry is collapsing under AI-generated low-quality reports. HackerOne paused the Internet Bug Bounty program on 2026-03-27 after 13 years; curl ended its program in January; valid-submission rates at major OSS programs fell from ~15% to under 5%. The bottleneck has shifted from **discovery** to **validation** — and that is the bottleneck TriageGuard attacks. The orchestrator (Python, Claude Agent SDK) fans out four parallel Opus 4.7 sub-agents at `xhigh` effort: - **Reproducibility** — clones the target, builds with ASan in a Docker sandbox, runs the PoC, parses sanitizer output. - **Root Cause** — opens the claimed source and checks the data-flow claim. - **Duplicate** — queries NVD via a custom SDK MCP tool. - **Hallucination** — cites or rejects every concrete technical reference (function names, line numbers, CVE IDs). Each sub-agent writes a strict JSON artifact to `findings/{report_id}/`. A **deterministic synthesizer** (no LLM) maps the four artifacts to a 0–100 Signal Score using the rubric in `signal-score-rubric/SKILL.md`. The verdict is auditable, reproducible, and cheap. Haiku 4.5 runs a preflight digest before fan-out (~$0.0015, ~1.5s) that extracts the report's claimed bug class, locations, and evidence — surfaced in the CLI and the synthesizer narrative as a fast sanity check. The web UI streams the same artifacts via SSE. Primary target: **wolfSSL** (~5B devices). The eval set includes two of my own published wolfSSL CVEs (CVE-2026-3849, CVE-2026-2646), plus two public curl slop reports and one live-generated slop sample. Built by a bug-bounty researcher with 9 published CVEs across wolfSSL, Mozilla NSS, and PowerDNS. *"I helped create this crisis. TriageGuard is my contribution to solving it."*