I have been using Claude Code for bug bounty a lot and I see this pattern a lot in my workflow. Me: Scan for vulnerabilities in this target CC: This is interesting. I found 10 vulnerabilities. 2 Critical. 5 High. 1 Medium. 1 Low. Me: I am interested in only Medium+ CC: Now we have 9 valid vulnerabilities. Me: Reassess all 9 like an H1 triager CC: Good suggestion. Let me do that. After reassessment I can see there are only 3 valid ones left. Most of them were by design. Me: Reassess the pending valid ones with the assumption that the attacker is an external user and does not have access to internal systems. CC: All the findings are invalid. Sorry about that, I should have analyzed it correctly. I will be careful from the next target onwards. This happens every time 🤣🤣 and every time Claude Code's confidence level is 2000%. I have been trying to add these instructions in CLAUDE.md but it seems to not care about them at all. 😅😅😅😅 Jokes aside, Claude Code is really good if you use it correctly. I have already reported 2-3 reports fully found by Claude Code (using the above conversation workflow). I am still working on getting a perfect workflow setup.