I sent the same root cause twice, so I built a local Gemma check before the next report

Description and use

A bug‑bounty researcher built BeforeReport, a local CLI that checks a draft report against past submissions using Gemma 3 4B to detect root‑cause repeats and returns a caution with exact excerpts.

Problem

Independent bug bounty researchers risk submitting duplicate reports because program trackers do not show private submissions and keyword searches miss semantically similar cases.

Outcome

In a synthetic test set of 15 pairs, BeforeReport matched 14 cautious‑versus‑distinct labels, with no false clearances and only one false alarm. A real retrospective on the author’s own reports also flagged a repeat.

Workflow

• 1. Export prior reports to CSV or JSON
• 2. Run BeforeReport CLI with the draft report
• 3. CLI groups prior cases by program name or ID
• 4. For each matching case, the CLI sends the draft and prior description to a local Gemma 3 4B model
• 5. The model returns a decision and verbatim excerpts
• 6. CLI verifies excerpts exist in the supplied texts
• 7. CLI outputs a caution if a repeat is flagged, otherwise a distinct or review_needed status

Evidence

I built BeforeReport, a small, local second look for that moment before sending.

Source

It compares the draft with earlier cases for the same program, asks a local Gemma 3 4B model whether the root cause repeats, and returns a caution with exact excerpts from both records.

Source

The reproducible smoke test contains 15 hand‑written synthetic pairs. The complete workflow matched 14 cautious‑versus‑distinct labels; a fixed token‑overlap baseline matched 11.

Source