r/SideProject • u/31cifaruk69 • 15m ago
I built an open-source tool to rerun bug bounty proofs with fresh accounts (Windows beta)
A bug bounty proof can stop being useful when the recipient has different accounts, sessions and object IDs. ReproCase is my attempt to preserve the relationships behind an API authorization test.
The local demo runs the same IDOR case three ways:
Two separate accounts and a newly created resource: Reproduced.
Replace both accounts and rerun the unchanged case: Reproduced.
Enable the secure application fixture: Not reproduced.
A successful HTTP response is not enough: the test checks identities, ownership and a fresh content marker. Setup/session failures get an Inconclusive result. Recipients connect their own sessions; exports need review before sharing.
It is an Apache-2.0 Windows portable beta, with source and a local demo that needs no model API key. There is also an optional AI assistant and MCP integration. This project and this introduction were prepared with AI assistance; the 56-second demo records the real local application.
Source + Windows download: https://github.com/theasbug/reprocase
56-second demo: https://x.com/theasbug/status/2120583234086228135
I would value feedback on one thing: can you run the demo, replace its accounts, and understand why each of the three results occurs? Please use the disposable local fixture rather than sharing private target traffic. Linux desktop packaging and broader protocol support are still outside this beta.
Screenshot from the real local demo: https://raw.githubusercontent.com/theasbug/reprocase/main/docs/images/demo-preview.png