From 248beda629d8a17ecdf1ef7c4689a662efc2546c Mon Sep 17 00:00:00 2001 From: Tester Date: Sat, 4 Jul 2026 03:46:29 +0200 Subject: [PATCH] feat(cve-json): classify .ai service handles as tool credits Bot-credit detection matched hyphenated -ai/-agent/-gpt handles but not domain-style AI-service handles like `bugbunny.ai`, so an AI bug-hunting service credited by its .ai product handle landed as type:finder instead of type:tool. Add a `\b[\w-]+\.ai\b` pattern, a policy-doc bullet, and two test cases (bugbunny.ai, xbow.ai). Generated-by: Claude Code (Claude Opus 4.8) --- tools/cve-tool-vulnogram/bot-credits-policy.md | 3 +++ .../generate-cve-json/src/generate_cve_json/cve_json.py | 1 + .../generate-cve-json/tests/test_generate_cve_json.py | 2 ++ 3 files changed, 6 insertions(+) diff --git a/tools/cve-tool-vulnogram/bot-credits-policy.md b/tools/cve-tool-vulnogram/bot-credits-policy.md index cbebe96e..77d0a2a7 100644 --- a/tools/cve-tool-vulnogram/bot-credits-policy.md +++ b/tools/cve-tool-vulnogram/bot-credits-policy.md @@ -88,6 +88,9 @@ A handle or email is *obvious bot/AI* when **any** of these match: these case-insensitive regex patterns: * `*-bot`, `*bot` (e.g. `securitybot`, `release-bot`) * `*-ai`, `*ai` (e.g. `scan-ai`, `securityai`) + * `*.ai` — domain-style AI-service handles (e.g. `bugbunny.ai`, + `xbow.ai`); an AI bug-hunting service credited by its `.ai` + product handle is a tool, not a human finder * `*-agent`, `*agent` (e.g. `triage-agent`) * `*-gpt`, `*gpt` (e.g. `secaudit-gpt`) * `*scanner*`, `*-scan` (e.g. `securityscanner-7`, `audit-scan`) diff --git a/tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py b/tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py index cabc1e5e..2a865cba 100644 --- a/tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py +++ b/tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py @@ -350,6 +350,7 @@ def _populate_constants() -> None: re.compile(r"\b[\w]*-bot\b", re.IGNORECASE), re.compile(r"\b[\w]+bot\b", re.IGNORECASE), re.compile(r"\b[\w]*-ai\b", re.IGNORECASE), + re.compile(r"\b[\w-]+\.ai\b", re.IGNORECASE), re.compile(r"\b[\w]*-agent\b", re.IGNORECASE), re.compile(r"\b[\w]*-gpt\b", re.IGNORECASE), re.compile(r"\b[\w]*scanner[\w]*\b", re.IGNORECASE), diff --git a/tools/cve-tool-vulnogram/generate-cve-json/tests/test_generate_cve_json.py b/tools/cve-tool-vulnogram/generate-cve-json/tests/test_generate_cve_json.py index a8308f34..e0bbaa71 100644 --- a/tools/cve-tool-vulnogram/generate-cve-json/tests/test_generate_cve_json.py +++ b/tools/cve-tool-vulnogram/generate-cve-json/tests/test_generate_cve_json.py @@ -194,6 +194,8 @@ def test_known_name_matches_inside_free_form_string(self, name: str): "release-bot", "securitybot", "scan-ai", + "bugbunny.ai", # domain-style AI-service handle + "xbow.ai", "triage-agent", "secaudit-gpt", "securityscanner-7",