Hugging Face's logo

Spaces:
BugTraceAI
/
README
Configuration error

App Files Community
README / README.md
Albert-yz9yt's picture
Albert-yz9yt
Expand model descriptions: dedicated section for Ultra and Apex, remove tables
cefe82d verified
preview code
|
raw
history blame contribute delete
3.4 kB
metadata 
title: README
emoji: 🏢
colorFrom: red
colorTo: purple
sdk: static
pinned: false

BugTraceAI

BugTraceAI provides fine-tuned language models designed for application security validation, authorized web pentesting, security engineering, and offensive security research.

The model lineup is split into two distinct families with different purposes:

🔧 CORE — Tooling Models

CORE models are built for integration into pipelines, agents, and automated workflows. They follow instructions precisely, produce structured output (JSON, templates, PoC skeletons), and are optimized for tool use — not open-ended reasoning.

BugTraceAI-CORE-Fast — The lightweight option. Designed for high-frequency tasks where latency matters: triage, log classification, finding categorization, quick field extraction from existing reports.

BugTraceAI-CORE-Pro — Mid-tier capacity. Handles long-context tasks: full report generation from raw findings, code review, exploit-chain documentation, and remediation guidance with context coherence across thousands of tokens.

BugTraceAI-CORE-Ultra (27B) — The most capable CORE model. Based on Qwen3-27B, fine-tuned via SFT on 2,541 curated examples covering bug bounty reports, malware analysis, and WAF evasion techniques. Available in two GGUF quantizations:

  • Q4_K_S with IMatrix (15 GB) — recommended for RTX 3090/4090, A4000
  • Q6_K (21 GB) — maximum fidelity for A5000/A6000, H100 or custom requantization

Use CORE models when you need reliable, structured output that feeds into a pipeline or automation layer.

🌋 Apex — Reasoning Model

Apex is built for deep offensive security reasoning. It thinks through problems step by step inside a <thinking> block before producing its answer, making it ideal for tasks where understanding why matters as much as the output itself.

BugTraceAI-G4-Apex — 26B Mixture-of-Experts model based on Gemma 4, fine-tuned via DPO on elite bug bounty reports, malware research, and WAF evasion techniques. Before every response it produces a full internal <thinking> block where it works through the problem step by step — making it ideal for tasks where the reasoning process matters as much as the answer.

Use Apex when you need the model to reason deeply about a problem rather than execute a structured task.

What the Framework Focuses On

  • Agentic web pentesting workflows
  • Application security and bug bounty operations
  • Finding triage and validation support
  • Reproduction notes and remediation guidance
  • Technical reporting for engineering and security teams

Responsible Use

BugTraceAI systems are intended for authorized security work, defensive research, education, and engineering support. Users are responsible for validating outputs and ensuring legal authorization before acting on any generated content.

Links