trailofbits/buttercup

View on GitHub

Buttercup finds and patches software vulnerabilities

Stars: 1.7k
Forks: 185
Open beginner issues: 0
Indexed issues: 51
Avg merge: 51m
Merged PRs (30d): 1

Dominant language: Python
License: AGPL-3.0
Last GitHub push: Aug 31, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

51 open issues indexed

Similarity check is too generous for shallow call stacks Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#409 · 2 comments · Opened Jan 8, 2026
Can `make signoz-ui` be run without needing to login? Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

trailofbits/buttercup#393 · 1 comment · Opened Nov 21, 2025
Provide an easier way to run Buttercup with pre-built images from ghcr.io Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#392 · Opened Nov 21, 2025
Are prebuilt Docker containers available? (as an alternative to using locally built ones that I have haven't been able to get to work) Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#391 · 3 comments · Opened Nov 21, 2025
Add support for self contained local deployment Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

trailofbits/buttercup#389 · Opened Nov 13, 2025
Add configuration options for longer-running seed-gen vulnerability discovery Open

seedgen

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#388 · 1 comment · Opened Nov 13, 2025
Improve support for extensively analyzing a single project Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

trailofbits/buttercup#387 · Opened Nov 13, 2025
POV summary Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#376 · Opened Oct 25, 2025
Revert to upstream oss-fuzz when PR is resolved Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#369 · 1 comment · Opened Oct 3, 2025
Allow for class names in lookup of methods Open

contextualizer enhancement :sparkles:

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#361 · Opened Sep 16, 2025
patcher: Split find_tests step into separate component Open

patcher

Difficulty 4/5 3-5 days Newbie friendliness 38/100

trailofbits/buttercup#356 · Opened Sep 12, 2025
buttercup-ui: do not send the full PoV as it can be several MB Open

ui

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#355 · 1 comment · Opened Sep 12, 2025
Track PoV origin in redis Open

fuzzer seedgen

Difficulty 3/5 1-2 days Newbie friendliness 45/100

trailofbits/buttercup#352 · 1 reaction · Opened Sep 11, 2025
Fuzzer runner-proxy uses`.communicate()`, but that's risky if stdout/stderr are huge Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#350 · Opened Sep 10, 2025
Split build-bot/coverage-bot/tracer-bot Dockerfile from fuzzer-bot Open

devops fuzzer

Difficulty 3/5 1-2 days Newbie friendliness 45/100

trailofbits/buttercup#349 · Opened Sep 9, 2025
Implement k8s autoscaling Open

devops

Difficulty 5/5 Over a week Newbie friendliness 15/100

trailofbits/buttercup#348 · Opened Sep 9, 2025
patcher: Replace patch building step with build-bot Open

patcher

Difficulty 5/5 Over a week Newbie friendliness 20/100

trailofbits/buttercup#347 · Opened Sep 9, 2025
patcher: Replace POV reproduce step with pov-reproducer service Open

patcher

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#346 · 1 comment · Opened Sep 9, 2025
Replace tracer-bot with orchestrator + pov-reproducer Open

orchestrator

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/buttercup#345 · Opened Sep 9, 2025
Expose coverage information in the UI Open

enhancement :sparkles: ui

Difficulty 4/5 3-5 days Newbie friendliness 42/100

trailofbits/buttercup#334 · Opened Sep 3, 2025
Allow user to access the stack-trace of PoV in the UI Open

enhancement :sparkles: ui

trailofbits/buttercup#332 · 1 assignee · Opened Sep 3, 2025
diagnose problem with patcher integration test `test_retrieve_context_basic` Open

patcher

trailofbits/buttercup#324 · 1 comment · 1 assignee · Opened Aug 26, 2025
Fork-mode of libfuzzer Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#323 · 4 comments · Opened Aug 26, 2025
Migrate Patcher from Manual Prompts to DSPy Framework Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

trailofbits/buttercup#322 · 1 comment · Opened Aug 25, 2025
re-deployments of buttercup break Signoz login Open

devops

trailofbits/buttercup#319 · 4 comments · 1 assignee · Opened Aug 21, 2025
Deployment Script Creates Resources Outside of Helm, Causing Conflicts on Re-deployment Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

trailofbits/buttercup#317 · Opened Aug 21, 2025
Helm Deployment Fails: litellm-api-user Secret Not Created, Blocking Patcher and Seed-gen Pods Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

trailofbits/buttercup#315 · 1 comment · Opened Aug 21, 2025
Support Python projects Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

trailofbits/buttercup#307 · Opened Aug 20, 2025
not supporting deployment behind proxy Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

trailofbits/buttercup#304 · 3 comments · Opened Aug 20, 2025
Allow configuration for local inferencing. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#303 · 1 comment · 1 reaction · Opened Aug 19, 2025
Remove clusterfuzz vendored code Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

trailofbits/buttercup#302 · Opened Aug 19, 2025
Allow context gathering to exit early Open

seedgen

Difficulty 3/5 1-2 days Newbie friendliness 48/100

trailofbits/buttercup#301 · Opened Aug 19, 2025
Add other OSS-Fuzz fuzzers Open

fuzzer

Difficulty 4/5 3-5 days Newbie friendliness 42/100

trailofbits/buttercup#300 · Opened Aug 19, 2025
Rewrite patcher's tests with FakeMessagesListChatModel Open

patcher

Difficulty 3/5 1-2 days Newbie friendliness 50/100

trailofbits/buttercup#298 · Opened Aug 19, 2025
Explore speculative vuln discovery and patching strategies used by Theori Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

trailofbits/buttercup#297 · Opened Aug 19, 2025
Re-enable seed-gen component integration tests Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

trailofbits/buttercup#296 · Opened Aug 18, 2025
Integrate Buttercup with new targets Open

trailofbits/buttercup#279 · 1 assignee · Opened Aug 13, 2025
rename challenges in `tob-challenges` to be consistent with each other Open

trailofbits/buttercup#247 · 2 assignees · Opened Aug 4, 2025
Deploy a local LangFuse and log there by default Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

trailofbits/buttercup#227 · 2 comments · Opened Aug 1, 2025
Create a `submit-project` script/make-target to guide the user through submitting a custom challenge Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

trailofbits/buttercup#220 · 4 comments · Opened Aug 1, 2025
remove unnecessary mirrors etc in `tob-challenges` Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

trailofbits/buttercup#215 · 1 comment · Opened Jul 31, 2025
Improve error reporting for advanced troubleshooting Open

enhancement :sparkles:

Difficulty 5/5 Over a week Newbie friendliness 30/100

trailofbits/buttercup#170 · 3 comments · Opened Jul 24, 2025
Adapt Buttercup to new libfuzzer-compatible languages Open

trailofbits/buttercup#150 · 1 assignee · Opened Jul 9, 2025
Make more values configurable Open

seedgen

trailofbits/buttercup#144 · 2 comments · 1 assignee · Opened Jul 8, 2025
Explore using RAG Open

contextualizer enhancement :sparkles:

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/buttercup#136 · Opened Jul 7, 2025
patcher: deal with long context Open

enhancement :sparkles: patcher

Difficulty 5/5 Over a week Newbie friendliness 25/100

trailofbits/buttercup#135 · Opened Jul 7, 2025
patcher find_tests takes too long, should fail earlier Open

patcher

Difficulty 4/5 3-5 days Newbie friendliness 20/100

trailofbits/buttercup#131 · Opened Jul 7, 2025
Sometimes cscope incorrectly identifies a function or not at all Open

contextualizer

trailofbits/buttercup#117 · 1 assignee · Opened Jul 1, 2025
Create REST api interface to program-model Open

contextualizer

trailofbits/buttercup#116 · 2 comments · 1 assignee · Opened Jul 1, 2025
Explore improving get_callers/get_callees Open

contextualizer

trailofbits/buttercup#115 · 1 assignee · Opened Jul 1, 2025

trailofbits/buttercup

Get new issues in your inbox