{"slug": "using-typesafe-ai-in-bug-bounty", "title": "Using TypeSafe AI in Bug Bounty", "summary": "A bug bounty researcher processed 17 subdomains per second, or roughly 1,040 domains per minute, using the TypeSafe AI model, which is priced at $0.042 per million input tokens with output tokens free. The researcher spent $1.29 of a $5 credited balance on the first day of heavy, unoptimized use, applying TypeSafe's Choice, Score, and Noul question types to classify reconnaissance pages such as S3 buckets, directory listings, and internal admin tools. TypeSafe differs from chatbots like ChatGPT and Claude by returning predefined multiple-choice answers, rubric-based scores, or true/false responses with confidence scores rather than holding conversations.", "body_md": "# Using TypeSafe AI in Bug Bounty\n\nToday I got access to TypeSafe. If you aren't familiar with the product, it's an ultra-fast and incredibly cheap AI model. When I say cheap, I'm talking **$0.042 per million input tokens, with output tokens completely free**.\n\nThey already had $5 credited to my account, and even with fairly heavy usage and zero optimization, I've only spent **$1.29** on the first day. But just wait until you hear what I was able to accomplish with that.\n\nSo, what's different about TypeSafe?\n\nIt doesn't work like a traditional chatbot such as ChatGPT or Claude. You don't have conversations with it or ask it questions in the same way. What it does excel at is **categorization and decision-making at extremely high speeds**.\n\nIt can accept three types of questions:\n\n**Choice** – Returns a predefined multiple-choice answer along with a confidence/probability score.\n\n**Score** – Returns a score based on a defined rubric along with a confidence/probability score.\n**Noul** – Returns a simple true or false.\n\nThis structure allows the AI to respond in near real time, enabling fast decision-making without the latency you normally experience with most AI models.\n\nOnce I got access, I immediately wanted to incorporate it into my bug bounty workflow. I wanted something that could handle both **large scale and high speed**.\n\nWhen you're doing bug bounty reconnaissance and enumeration, you can quickly end up with a massive number of websites and subdomains to process. Traditionally, you have a few options, each with its own downsides:\n\n- **Manual review** – Can take days to weeks to complete\n- **Eyeballer** – Takes minutes, but results can be mixed because of the limited model\n- **Frontier models** – Powerful, but expensive. They can consume millions of tokens just to review webpages\n- **Local LLMs** – Flexible, but slow, and they don't always have the context windows needed to process full webpages\n\nWith my first test using TypeSafe, I was able to process **17 subdomains per second**.\n\nThat's approximately **1,040 domains per minute**.\n\nTo accomplish this, I first came up with a set of questions broad enough to apply to almost every website.\n\n### Question 1\n\n**Does the visible page text below contain enough information to judge what this page actually is?**\n\nThis helps eliminate false negatives. Some websites time out or don't load correctly because many of them are non-production environments.\n\n### Question 2\n\n**What kind of page is this, based on its title, headers, and visible text?**\n\n- Portal\n- Login\n- Directory Listing\n- Bucket\n- Default Install\n- Out of Date\n- Internal Tool\n- Broken\n- Boring\n\nClearly, in a bug bounty situation, you want to pull out things like S3 buckets, directory listings, and internal tools. \"Broken\" is a bit too broad of a category, and I would probably break it up further in future versions.\n\n### Question 3\n\n**Does this look like an internal admin, staff, or Ops tool that wasn't meant to be public?**\n\nPretty self-explanatory. We're continuing to look for accidental exposure.\n\n### Question 4\n\n**Does this look like a login or management tool for a network security application, VPN gateway, or remote access product?**\n\nWhile many of these products could be classified as internal tools, we want to specifically call them out because they are often intentionally exposed to the internet.\n\n### Question 5\n\n**Does this look like the login page of an IT management, RMM, or monitoring tool?**\n\nThis includes products like Grafana, SolarWinds, Splunk, etc.\n\n### Question 6\n\n**Does this response directly expose sensitive data itself rather than just linking to it?**\n\nBecause TypeSafe is looking at the HTML itself rather than screenshots, we can quickly identify things like API keys sitting directly on a landing page. This would be rare, but it's also something that's too easy to overlook.\n\n### Question 7\n\n**How interesting is this host for security testing?**\n\nThis is the first time we're using the Score question type. It gives us a useful number to work with when determining whether a host is worth investigating further.\n\nThe responses were saved to a CSV file, making them easy to review and even easier for AI to filter through. Once I had the results, I had Claude take the top 20 highest-scoring results across different categories and put them into text files.\n\nI use the Chrome extension [__Open Multiple URLs__](https://chromewebstore.google.com/detail/open-multiple-urls/oifijhaokejakekmnjmphonojcfkpbbh?hl=en) to quickly review the results manually. After a quick review, I pass the interesting results to Claude for further analysis to look for sensitive or exposed content.\n\nThis was just a quick post to show what Jev is able to do. I think Jev is going to be a valuable tool for anyone in the offensive security space, and I can't wait to see some of the other projects people build with it. We're already starting to see them pop up.\n\n[__https://github.com/browser-use/jev-ultrafast__](https://github.com/browser-use/jev-ultrafast)\nThis was only my first day using Jev, but working with this speed, cheap cost and flexibility is what sells me. \n\nInstead of sending thousands of hosts directly to an expensive frontier model or spending hours manually reviewing them, Jev can act as a high-speed filtering layer. This is a must have for your enumeration layer at scale. \n\nFor offensive security, I think that's where this gets really interesting. The goal isn't to replace manual testing or more powerful AI models. It's to make sure you're spending your time and compute on the things that actually deserve it.\nGo ahead and check it out. Let me know if you make any cool offensive security projects with it. \n__https://typesafe.ai/__", "url": "https://wpnews.pro/news/using-typesafe-ai-in-bug-bounty", "canonical_source": "https://www.lampysecurity.com/post/using-typesafe-ai-in-bug-bounty", "published_at": "2026-09-21 15:34:32+00:00", "updated_at": "2026-09-21 15:53:54.631000+00:00", "lang": "en", "topics": ["ai-tools", "ai-products", "artificial-intelligence"], "entities": ["TypeSafe", "ChatGPT", "Claude", "Eyeballer", "Grafana", "SolarWinds", "Splunk"], "alternates": {"html": "https://wpnews.pro/news/using-typesafe-ai-in-bug-bounty", "markdown": "https://wpnews.pro/news/using-typesafe-ai-in-bug-bounty.md", "text": "https://wpnews.pro/news/using-typesafe-ai-in-bug-bounty.txt", "jsonld": "https://wpnews.pro/news/using-typesafe-ai-in-bug-bounty.jsonld"}}