> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/useful-resources/bug-bounty.md).
# 漏洞赏金
漏洞赏金案例研究、负责任披露笔记、真实 PoC、影响分析、修复指导和报告工作流。
真实世界漏洞研究笔记和负责任披露案例研究。本节适用于不属于 CTF 题解、也不属于通用方法论页面的发现：实际报告、PoC、影响说明、修复说明以及经验教训。
{% hint style="info" %}
仅将本节用于已授权的研究。请勿在公开笔记中包含敏感令牌、私有 URL、客户数据或尚未发布的供应商细节。
{% endhint %}
## 案例研究
:robot:
GitBook AI 助手重放 PoC
关于已修复的 GitBook AI 助手服务器操作重放问题的负责任披露案例研究，涉及权限、范围、预览模式和会话强制执行。
## 如何使用本节
1. 先写简短的影响和状态。
2. 解释易受攻击的流程，但不要泄露敏感的实时数据。
3. 将观察到的内容与推断内容分开。
4. 仅在问题已修复或已安全限定范围时，添加一个简短的复现摘要。
5. 最后写上修复措施以及未来测试的经验教训。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/useful-resources/bug-bounty.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.