Use nuclei and templates to empower a bug bounty or authorized assessment engagement hunt to the full capabilities of crowdsourced security. see ./references/install.md for first installation of nuclei on the environment

Methodology

1. Index once into id, path, severity, tags, tier, replicable; rebuild only when the templates tree mtime changes. See references/browsing.md for traversal.
2. Confirm scope before any run: in-scope hosts, desired posture (e.g. passive v.s. active scan), and whether OAST callbacks are workable within the enivronment.
3. Tier by blast radius from template contents: file/, dns/, ssl/ and single benign GETs are safe; intrusive, brute, fuzz, unsafe: true and interactsh require extra user consideration; code/ executes on your own host and should almost never be used. Honor .nuclei-ignore and never exceed the confirmed ceiling.

Run preferences

Run the scoped set with -duc (disable the update check, which otherwise stalls scripted runs), -jsonl -irr -store-resp -srd <dir> for structured output plus captured request/response, -etags above the cap, -rl rate limiting, and a self-hosted OAST server if callbacks are permitted. On a target that returns a 200 catch-all (SPA app shell), prefer content/word matchers over status-only templates, which false-positive. Treat a skipped template as unrun, not clean.

Output

Surface every finding, ranked by severity, with: its template-id; a full clickable template link, https://github.com/projectdiscovery/nuclei-templates/blob/<sha>/<template-path> where <sha> is git -C <clone> rev-parse HEAD, commit-pinned so the link is the exact template that fired; the matched-at URL; and the captured evidence, http/dns from the JSONL request/response and ssl/network from the stored file under -srd. In the response, re-run the template's own matcher (words/regex/dsl) to locate the indicator and mark it: ANSI-highlight the matched span in a terminal, caret-underline it when piped no-color, and name the pattern that fired.

Researcher needs to know exactly which templates were executed, and if some returned true positive, then the exact request/response or execution log and what indicator is bad.