Blog

Shipping submittable security-agent output

Deterministic grading, the anti-slop case, and how to know a bug-bounty report is accept-worthy before you send it.

• Grading the report, not the flag: what Ethiack’s pentesting-agent benchmark gets right

  Ethiack’s EthiBench measures which agent is better on average. BountyReady grades whether one report is submittable. Here’s the difference.

• Deterministic, hidden-ground-truth grading for bug-bounty reports: the BountyReady methodology

  How BountyReady grades a bug-bounty report before submission — deterministically, no LLM, against hidden ground truth. Proof tokens, negation-aware matching, and the verdict ladder.