# Zeke

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [jeffin sam](https://cerebralvalley.ai/u/jeffin14)
- **GitHub:** https://github.com/jeff13in/burp-to-report
- **Demo video:** https://youtu.be/Z2MoXrfxE-w
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4849

Burp-to-Report is an AI triage copilot for web security testers. It takes a Burp Suite HTTP history export or a HAR file from an authorized test and turns thousands of requests into a short, ranked list of findings, each backed by evidence. Then it turns those findings into a bug bounty report ready to submit.

The problem: I’m working toward the Burp Suite Certified Professional and do bug bounty work. A single test produces thousands of requests. Most of the time goes into scrolling the history looking for broken access control, reflected input or leaked data, and then writing each report by hand. Beginners miss real bugs, and experienced testers lose hours.

How it works:

It parses Burp XML or HAR and drops noise: static assets, duplicates and out-of-scope hosts.
Six heuristic detectors flag candidates and record the exact evidence that triggered them. They cover IDOR, missing authorization, reflected input, verbose errors, sensitive data exposure and CORS misconfiguration with credentials.
Muse Spark reviews each candidate. It gets the redacted traffic and the most relevant documents from a local reference knowledge base. It decides whether the issue is real, rates its severity, and has to quote its evidence and cite its sources.
A validation layer checks every quote word for word against the captured traffic, and every citation against the documents the model was given. Claims that don’t hold up are dropped or downgraded, and each finding shows what was removed and why.
The tester accepts, rejects or edits each finding in a React review UI with keyboard shortcuts. Nothing is reported automatically.
Accepted findings export as Markdown. The reproduction steps come from the real captured requests, not from the model.

## More from Meta Global AI Developer Hackathon

- [Paper Tour](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4846)
- [Abuja City Life Ai Town](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4847)
- [Trained Eye](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4848)
- [Wardrobe Stylist](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4850)
- [Ahnaf_Lab_X](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4851)
- [Ryan Bell (solo)](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4852)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4849. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt