BugSlyce
BugSlyce is a local-first, evidence-led recon triage tool for authorised labs, CTFs and scoped assessments. It runs bounded project workflows, preserves local artefacts, builds operator reports and helps prioritise manual review.
BugSlyce is not an exploitation framework, vulnerability scanner or automated pentesting platform. Its reports describe observed evidence and review leads; BugSlyce does not claim confirmed vulnerabilities.
Temporary production bug bounty warning
BugSlyce 1.1.1 is a documentation-only safety advisory release. It does not change live reconnaissance behaviour.
Controlled testing against a local HTTP capture server found that Standard Recon peaked at 154 requests per second and Deep Recon peaked at 450 requests per second. The current implementation also cannot consistently apply programme-required researcher-identification headers across every HTTP request path.
Do not use Standard or Deep Recon against production bug bounty targets until request pacing and identification-header support have been added and verified. Do not use any live mode where required traffic-identification rules cannot be honoured.
BugSlyce remains suitable for CTFs and controlled authorised labs. No production target was involved in discovering these issues.
The unreleased R0B2 source contains central internal HTTP enforcement and policy-aware external-tool planning and enforcement foundations. Curl shares aggregate pacing and traffic identity with internal HTTP. Compatible Gobuster plans use one thread, a conservative delay and the configured identity. Strict bug bounty Nmap plans perform TCP port-state discovery only; incompatible required curl or Nmap capability blocks preflight, while incompatible optional Gobuster is omitted rather than weakened.
All live bug bounty reconnaissance entry points remain blocked pending R0B3 controlled capture acceptance. Save or update policy configuration without running recon:
bugslyce project policy --project ./bugslyce_project.json --configureNo platform preset supersedes current programme rules. CTFs and controlled authorised labs remain the supported live-testing contexts.
Current package version: 1.1.1.
Authorised Use
Use BugSlyce only against systems you own or are explicitly authorised to assess. The generated scope.md template is a local safety aid, not proof of authorisation. Always review scope and programme rules before running recon.
Supported Host Expectations
BugSlyce is intended for Linux operator workstations. It has been developed and validated on Kali Linux and Linux Mint. Other Debian-derived Linux systems, including Ubuntu, are expected to work when the required Python version and external tools are available, but they are not currently part of the directly validated host set. Native Windows and macOS operation is not currently claimed.