Prove it
Bug-bounty platform ships plugin that tells hunters no.
25 August 2026
Ask a triager about their inbox — reports arrive full of themselves, CVSS up in the nines. Try to reproduce: nothing. The agent that wrote each met an evidence gap and filled it with faux proof. Triagers now spend their days dismissing overclaimed, non-existent bugs.
YesWeHack’s answer is plugin claude-kit, its personality reminiscent of Little Britain. A rule set is loaded up as hacking begins; Claude comes along for the ride, calling reality as the hunt goes on: claim more than evidenced and it’ll push back. The hunter forced to toe the line, what reaches the triager is no longer fiction.
Watching the plugin work reveals character. A hunter chasing a pricing bug has shown a discount in the cart; Claude guides the hunter back on track: nothing yet has shown survival through checkout — a bug, yes, vulnerability, no. It argues away from make-believe. Saves triagers hours of misery.
Computer says no.
A year ago the fear was AI burying triagers under convincing fakes. What the year produced instead was tools that push back — and, without comparing notes, they have arrived at the same rule, the one claude-kit prints into the agent at startup: draft from your verified facts, never over the gaps. That a bug-bounty platform now enforces is not fashion; it is our new orthodoxy.
Cybernuke reaches the same discipline for autonomous discovery. The plugin rides along and knows only what the hunt has shown; it can name the gap, it cannot say where to go, it guides its human. Both rest on one foundation, proof before prose, cybernuke with no person at all.
Neither is a criticism of the other. Writing-up and finding are different jobs, and the same discipline guards each; cybernuke does both, and the report it writes is held to what it gathered. The slop era does not end with agent discipline. It ends when the lies are crushed, when the triager’s inbox fills with evidence; their days returning to disaster aversion, no more fantasy parsing.