# Haruto Kimura

- **Event:** [Built with Opus 4.7: a Claude Code hackathon](https://cerebralvalley.ai/e/built-with-4-7-hackathon)
- **When:** Apr 21 at 12:00 PM – Apr 27 at 2:00 AM (EDT)
- **Where:** Online
- **Team:** [Haruto Kimura](https://cerebralvalley.ai/u/hkimura)
- **GitHub:** https://github.com/HarutoKimura/triageguard
- **Demo video:** https://youtube.com/shorts/jqrxefYqbO4?feature=share
- **Gallery:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/153

TriageGuard is an autonomous validator for vulnerability reports. Drop in a report + PoC + claimed affected code; it returns a Signal-vs-Slop verdict with auditable reasoning, end to end and unattended.

The bug bounty industry is collapsing under AI-generated low-quality reports. HackerOne paused the Internet Bug Bounty program on 2026-03-27 after 13 years; curl ended its program in January; valid-submission rates at major OSS programs fell from ~15% to under 5%. The bottleneck has shifted from **discovery** to **validation** — and that is the bottleneck TriageGuard attacks.

The orchestrator (Python, Claude Agent SDK) fans out four parallel Opus 4.7 sub-agents at `xhigh` effort:

- **Reproducibility** — clones the target, builds with ASan in a Docker sandbox, runs the PoC, parses sanitizer output.
- **Root Cause** — opens the claimed source and checks the data-flow claim.
- **Duplicate** — queries NVD via a custom SDK MCP tool.
- **Hallucination** — cites or rejects every concrete technical reference (function names, line numbers, CVE IDs).

Each sub-agent writes a strict JSON artifact to `findings/{report_id}/`. A **deterministic synthesizer** (no LLM) maps the four artifacts to a 0–100 Signal Score using the rubric in `signal-score-rubric/SKILL.md`. The verdict is auditable, reproducible, and cheap. Haiku 4.5 runs a preflight digest before fan-out (~$0.0015, ~1.5s) that extracts the report's claimed bug class, locations, and evidence — surfaced in the CLI and the synthesizer narrative as a fast sanity check. The web UI streams the same artifacts via SSE.

Primary target: **wolfSSL** (~5B devices). The eval set includes two of my own published wolfSSL CVEs (CVE-2026-3849, CVE-2026-2646), plus two public curl slop reports and one live-generated slop sample.

Built by a bug-bounty researcher with 9 published CVEs across wolfSSL, Mozilla NSS, and PowerDNS. *"I helped create this crisis. TriageGuard is my contribution to solving it."*

---

Markdown version of https://cerebralvalley.ai/e/built-with-4-7-hackathon/hackathon/gallery/153. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt