NEMETON — HTD Hunt Desk

Monk.io Bug Bounty — Hunt Loop

Follow every step in order. Do not skip steps. Two gates require your manual action. This is the exact workflow that produced Card #001.

Confirm eligibility — sign in + run the plugin

IN PROGRESS

You must have installed the Monk.io VS Code extension AND run the plugin at least once before the Aug 31 12:00 UTC deadline. Card #001 was confirmed because eligibility was already met.

Monk.io VS Code extension installed

Plugin run at least once (monkd started)

GitHub account signed in to monk-io/monk-plugin

Reproduce — reboot and observe ECONNREFUSED

WAITING

This is the exact reproduction sequence for #286. Run each command in PowerShell after rebooting your machine.

wsl --shutdown

Then reboot your machine. After reboot, open the Monk VS Code extension and observe the error.

wsl -l -v

Expected: distro shows "Stopped"

netstat -an | findstr 2137

Expected: no output (relay absent)

curl 127.0.0.1:2137

Expected: ECONNREFUSED

Rebooted machine

wsl -l -v shows distro "Stopped"

netstat shows port 2137 absent

curl 127.0.0.1:2137 returns ECONNREFUSED

Monk extension shows connection error

Collect evidence — 4 files to attach

WAITING

These are the exact 4 evidence files that were attached to #286. Save command output to text files.

wsl -l -v > wsl-list.txt

netstat -an | findstr 2137 > netstat-stopped.txt

curl 127.0.0.1:2137 2>&1 > curl-stopped.txt

wsl -- journalctl -u monkd --no-pager > monkd-journal.txt

wsl-list.txt saved

Shows distro in Stopped state

netstat-stopped.txt saved

Empty — port 2137 absent

curl-stopped.txt saved

Shows ECONNREFUSED

monkd-journal.txt saved

Service logs from inside WSL2

Classify the weakness — CWE

WAITING

Card #001 used CWE-923. For future findings, identify the correct CWE before writing the report.

Card #001 Classification

CWE-923 — Improper Restriction of Communication Channel to Intended Endpoints

Root cause: WSL2 localhost relay is not rebuilt after distro restart. monkd.service starts inside WSL but the Windows-side port-forward is absent until manual wsl --shutdown recovery.

Your CWE (this hunt)

Write report — copy-ready template

WAITING

This is the exact report format that produced #286. Edit the fields marked [EDIT] for your finding.

## Bug Report — WSL2 relay not rebuilt after reboot **Description:** After every reboot (or WSL idle-shutdown), the Monk VS Code extension fails with ECONNREFUSED 127.0.0.1:2137. The monkd.service starts correctly inside the WSL2 distro, but the Windows-side localhost relay (port 2137) is not re-established. The only recovery is manual: wsl --shutdown followed by restarting the distro. **Steps to reproduce:** 1. Install Monk VS Code extension, run plugin once (monkd starts OK) 2. Reboot machine (or run wsl --shutdown to simulate) 3. Open VS Code and activate the Monk extension 4. Observe: ECONNREFUSED 127.0.0.1:2137 **Expected:** Extension reconnects automatically after reboot **Actual:** ECONNREFUSED until manual wsl --shutdown recovery **Evidence attached:** - wsl-list.txt — distro shows "Stopped" - netstat-stopped.txt — port 2137 absent - curl-stopped.txt — ECONNREFUSED - monkd-journal.txt — service logs **CWE:** CWE-923 — Improper Restriction of Communication Channel **Impact:** medium — breaks connect/operate lifecycle after every reboot **Scope:** Local WSL2 environment only. No external target accessed. **Suggested fix:** Extension should detect ECONNREFUSED and automatically run wsl --shutdown followed by distro restart + relay re-establishment.

⛔ Human Gate — Captain reviews draft

GATE

STOP. Send the report above to the Captain for review. Do NOT file the issue until Captain approves. This gate cannot be bypassed.

Captain must confirm:
1. The report accurately describes what was found
2. No exploit content included
3. No live target accessed
4. Program is authorized

⛔ Human Gate — You file the issue on GitHub

GATE

YOU must file this issue. No agent can submit on your behalf. This is the final human gate.

Opened monk-io/monk-plugin/issues/new

Pasted report into the issue body

Attached all 4 evidence files

Clicked Submit — issue filed

↗ Open GitHub — File Issue Now

✓ CARD SEALED — MAAT RECEIPT

Program

monk-io/monk-plugin

CWE

—

Impact

medium

Belt earned

🥈 SILVER

Issue filed

—

Filed by

HTD (human — gate cleared)

MAAT seal

—

Timestamp

—

Status

✓ BOUNTY SUBMITTED — points pending confirmation

→ Notify Captain — open Captain dashboard