A Note-Taking System for Bug Bounty Hunters That Survives Chaos
The bug you almost had last Tuesday dies in browser history. Notes are how it lives long enough to pay.
Keep the system boring. Fancy databases fail when you are mid-race and need a paste buffer. If opening your vault feels like a productivity sermon, you will not open it.
One page per asset, not per random thought
A template that has survived real programs for me:
- Scope links and out-of-scope traps (third-party payment, marketing CMS, acquired domains)
- Auth model (SSO, roles, tenant header, API keys)
- Interesting endpoints (method + path + why it smelled odd)
- Questions still open
- PoC scraps and canary strings used
- Duplicate checks already run
Date your entries. When triage asks "when did you test?," you answer without guessing. Dates also show you when a "quick look" became a week-long hostage situation.
Separate program notes from technique notes. Technique pages ("IDOR checklist," "cache key probes," "invite flow map") get reused across targets. Program pages stay messy and specific. Mixing them creates a junk drawer you will never search.
Capture while proxying, not after
When something smells odd — a numeric user_id, a debug header, a slower admin route, a GraphQL field that returns more than the UI shows — jot it in the same minute. Future-you will not remember why X-Account-Context looked weird.
Store raw request/response pairs for promising threads in a folder keyed by slug, not scattered on the Desktop. Redact tokens before syncing to any cloud notebook. If your sync vendor gets popped, you do not want live sessions in the breach dump.
Tags help only if you keep them few: authz, cache, race, mobile, parked. Twenty pastel labels is cosplay.
Close loops deliberately
Every open question should die as done, dead end, or parked with reason. Infinite "look at Graph later" lists are how people burn out on one target and call it dedication.
A weekly twenty-minute review beats daily guilt. Skim parked items; promote anything that still looks cheap to verify; archive the rest with a one-line autopsy ("no object IDOR after role matrix").
When you file a report, link the note page in your private system. When you get paid or marked duplicate, update that page so your brain stops carrying the thread.
What not to hoard
Do not paste other hunters' private writeups into your vault. Do not keep live session cookies in plaintext notes. Do not screenshot customer PII "for later." Do not mirror an entire sitemap "just in case" if you will never read it.
Backup matters. An encrypted export once a month beats a tragic disk failure the week you had three half-finished Criticals in draft. Notes are inventory. Treat them that way.
Searchability beats perfection. A greppable plain folder of markdown often outruns a pretty database you never query.
Your notes exist to make your next hour sharper. Delete ceremony until the system feels light enough to use under pressure.