IdeaWell

Project ideas from Hacker News discussions.

I Found a $90k Remote Code Execution Vulnerability in Google

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

1. AI‑assisted discovery and attribution
Many commenters debated whether using LLMs like Claude to find a vulnerability should be credited to the human researcher or the model, and stressed the need for transparency about tool use.
- “If you really are still doing work and understanding and just using LLMs as a tool, show your understanding in your blog post… I don’t really care whether you used Claude and didn’t list it, if it’s clear as day you understand what you were doing with it.” — jchw
- “Would Claude have found it without your guidance and knowledge? If yes, Claude found it. If no, you found it while using an LLM.” — oooyay
- “Maybe the norm should be to credit the LLM and harness used, like ‘I used ___ to help me find an RCE’…” — consumer451

2. Ethics, legality, and the motive to report vs. resell
The discussion touched on whether bug‑bounty programs exist mainly to make reporting more profitable than selling exploits illegally, and how personal ethics factor in.
- “Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.” — elevation
- “Is this really true? After all, reselling the exploit would be illegal, and most people don’t want to break the law to earn income.” — Gander5739
- “Most people do not, but it needs only some people who do so for it to be a problem. Most people do not steal, but I still lock my front door.” — graemep

3. Economic outlook for bug bounties
Several participants argued that AI‑driven automation will reduce the value of bounties, making large payouts rare and shifting the field toward more commoditized work.
- “We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens.” — elevation
- “People who pay bounties for vulnerabilities don’t really care how you find them.” — j45
- “There are enough people operating in countries that would not charge them for hacking an American company for it to matter, $90k can be a life‑changing sum.” — micromacrofoot

🚀 Project Ideas

Generating project ideas…

DiscloseAI – Transparent LLM Usage Tracker for Bug Bounty Reports

Summary

  • A lightweight web app that guides bug‑bounty hunters to annotate each step of their exploit write‑up with AI‑assistance tags and automatically generates a disclosure section.
  • Core value proposition: ensures clear attribution of LLM help, satisfies community demand for transparency, and protects hunters from accusations of undisclosed AI use.

Details

Key Value
Target Audience bug‑bounty researchers, security bloggers, HN commenters concerned about AI credit
Core Feature interactive editor with inline tagging (e.g., [AI], [Human]) and auto‑generated disclosure footer; export to Markdown/HTML
Tech Stack React frontend, Node.js/Express backend, SQLite storage, optional OpenAI API for tag suggestions
Difficulty Medium
Monetization Revenue-ready: Subscription $5/mo per user

Notes

  • Quote: jchw: “If I post an image and I say, 'I drew this', and someone says, 'no you didn't. That is clearly output from Qwen Image 2.1' …” – shows desire for transparent tool use.
  • Could spark discussion on HN about proper attribution and reduce flame wars over LLM credit.

BountyBench – Skill Verification & Mentorship Platform for Aspiring Bug Hunters

Summary

  • A community platform where hunters submit vulnerability reports and must complete a short “explain‑in‑your‑own‑words” quiz to prove understanding before the post is accepted.
  • Core value proposition: filters out low‑effort, LLM‑generated write‑ups, rewards genuine skill, and provides mentorship feedback.

Details

Key Value
Target Audience aspiring bug‑bounty hunters, junior security engineers, mentors
Core Feature submission flow requiring a human‑written explanation (no copy‑paste) and optional replay script; community voting and expert review badges
Tech Stack Next.js frontend, PostgreSQL, AWS Lambda sandbox for code execution, optional GitHub integration for PoC storage
Difficulty High
Monetization Revenue-ready: Freemium – free basic submissions, premium $10/mo for detailed feedback and private mentorship

Notes

  • Quote: logicchains: “If it's so easy, then when didn't you do it? Easy $90k.” – reflects skepticism about claimed ease; platform would demand proof.
  • Encourages constructive discussion and helps build trust in bounty claims.

AuthentiScan – LLM‑Generated Content Detector for Security Write‑ups

Summary

  • A browser extension / HN plugin that scans posted write‑ups for LLM‑generated linguistic patterns and displays a confidence score, helping readers judge originality.
  • Core value proposition: gives readers a quick tool to assess whether a blog post likely relied heavily on AI, addressing concerns about undisclosed AI authorship.

Details

Key Value
Target Audience HN readers, tech blog editors, security community moderators
Core Feature real‑time highlighting of suspect sentences, overall AI‑likelihood metric, tooltip with evidence (e.g., n‑gram rarity, perplexity)
Tech Stack JavaScript/TypeScript extension, lightweight open‑source detection model (fine‑tuned RoBERTa) via WebAssembly or private API
Difficulty Medium
Monetization Hobby

Notes

  • Quote: jchw: “I don't really care whether you used Claude and didn't list it, if it's clear as day you understand what you were doing with it.” – extension helps make that clarity visible.
  • Could fuel HN debates about AI detection reliability and encourage better disclosure practices.

Read Later