The $1.5M bug bounty stack goes open source

What it does open-kritt is a self-hosted security research platform that chains focused prompts into reusable workflows, runs them across multiple AI agents in parallel, and collates the results into de-duplicated, ranked findings. You can point it at local or remote repositories, validate issues with post-scripts and proofs-of-concept, and pipe the output into your own severity rankers. It is essentially a workflow engine for turning model-generated noise into actionable vulnerability reports.

The interesting bit The project is not theoretical: the maintainers earned over $1.5 million in bug-bounty payouts under the handle Blockian, and open-kritt is the open-source release of the internal tooling behind that work. That pedigree shows in the design—agents run inside disposable, root-enabled containers with internet access so they can compile targets, install dependencies, and actually verify exploits rather than just flagging suspicious lines.

Key highlights

• Bring-your-own-model support for Codex, Claude Code, OpenAI, Anthropic, and OpenRouter.
• Workflow builder that breaks scans into small, focused prompts rather than monolithic repo dumps.
• Automatic de-duplication and a consistent finding schema to reduce alert fatigue.
• Post-scan validation scripts and proof-of-concept generation.
• Runs fully self-hosted via Docker, with a local web UI.

Caveats

• The backend ships without application authentication and binds to localhost by default, so the authors explicitly warn you to keep the stack private.
• Tool-enabled agents execute as root inside containers with direct internet access and writable repository copies, which means scanning untrusted code requires reading their threat model first.
• It is licensed under AGPL-3.0, which carries copyleft obligations.

Verdict Security researchers and bug-bounty hunters who want to automate the tedious parts of reconnaissance and validation should take a look. If you are looking for a managed SaaS scanner or a simple one-shot CLI tool, this is not it.