Most programs won't pay for scanner output and will require work that demonstrates the impact of the finding, etc. Several programs I've seen actually state that automated scans are out of scope and ask the bounty hunter not to use them. With that said, this may be a good recon tool to hunt for bugs, if its allowed by the target. I am not sure how much better itd be than Qualys or Nessus, etc though.

I like the idea for personal use. I was just looking for something similar the other day and for once I'm happy I don't need to build it.

No. The companies offering bug bounties have already done more than the bare minimum. Finding a vulnerability for a bug bounty requires actual work.

We did test it on Bug Bounty targets (see article) and found 2.5% of programs to suffer from at least one of these issues.

this seems to be airing a frustration that has moved beyond accuracy in the process, companies offering bug bounties may have done the bare minimum at one point in time but every production push they do changes that, and potentially reintroduces simple scannable vulnerabilities.

That's fair. We get numerous reports from script kiddies reporting "vulnerabilities" that aren't, because they don't understand the tool that they're running, or the output that it produces, or why it isn't relevant. It's possible that they catch a known issue, but the reality is that the majority have no idea what they're doing.

Useful for scanning your network for devices with known vulnerabilities.

Doesn't metasploit, OpenVAS and others already do a lot of this? Why not contribute modules there vs. write a new framework?

It seems to be using nuclei, metasploit etc. under the hood. I hope they recontribute the recipes though.

Yes everything added is open-sourced: Metasploit: https://github.com/Ostorlab/agent_metasploit Nuclei: https://github.com/Ostorlab/agent_nuclei OpenVas (not used though due to many issues): https://github.com/Ostorlab/agent_openvas Asteroid: https://github.com/Ostorlab/agent_asteroid