> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro-rules/reference.md).

# Format and current limitations

Understand rule conditions, action scopes and profile dependencies.

## Fields

| Field                                                                             | Type             | Meaning                                                                        |
| --------------------------------------------------------------------------------- | ---------------- | ------------------------------------------------------------------------------ |
| `enabled`                                                                         | Boolean          | Whether Smart Scan evaluates this rule.                                        |
| `name`                                                                            | String           | Rule name; referenced in the UI and saved filename.                            |
| `comments`                                                                        | String           | Explanation for the operator.                                                  |
| `match`                                                                           | Array of strings | Passive trigger rows.                                                          |
| `execute`                                                                         | Array of strings | Active action rows.                                                            |
| `scope`                                                                           | Integer          | Legacy serialized field; the current action scope is in each execute row.      |
| `match_enabled`, `exec_enabled`                                                   | Booleans         | Legacy/editor properties; row flags control the serialized conditions/actions. |
| `operator`, `profile_type`, `passive_profile_type`, `type`, `active_profile_type` | Strings          | Legacy/editor properties preserved in exports; do not replace the row arrays.  |

## Match row

```
enabled,operator,profile type,profile name
true,,Passive Request,Example_Debug_Query_Parameter
```

Operators offered by the editor are `And` and `Or`, with an empty first row. Types are `Passive Request` and `Passive Response`. Profile name is an exact reference to an installed profile. Conditions identify both the profile name and its passive request/response type; the reported issue title is not the identity.

## Execute row

```
enabled,type,name,scope
true,Profile,Example_Marker_Reflection,All Matches
true,Tag,Examples,All Matches
```

Type is `Profile` or `Tag`. Scope labels are `All Matches` and `First Match`. Only enabled active profiles are eligible. Overlapping actions within one rule execution are deduplicated by active profile name. Tag membership is live profile metadata; different rules can still select the same profile.

## Condition and action semantics

### And requires every condition in the same exchange

Enabled rows joined by `And` must all match the same HTTP request/response exchange before an action is queued. `Or` separates alternative groups: `A And B Or C` means `(A And B) Or C`. Disabled rows are ignored; malformed conditions do not trigger a rule.

Request and response detectors share evidence for that exchange. Matches from different requests cannot complete each other's conditions. A rule queues its selected work at most once per exchange. A matched passive profile can satisfy a condition even if its issue is hidden or already present in Burp.

### First Match is reserved atomically per origin

**First Match** queues an action once for each rule, action type/name and exact origin (scheme, host and port) during the loaded extension session. Concurrent matches compete for the same reservation, preventing duplicate submissions. A queue-admission failure releases the reservation for a later retry.

Reloading the extension resets this in-memory record. Once queued, cancellation or a later execution failure does not release it. It is not a persistent history or a request budget: a single action can still send many probes. Keep active concurrency and RPS limits appropriate for the target.

**All Matches** allows the action for each matching exchange. If several eligible actions select the same active profile in that rule execution, it is queued only once.

### Profile names and issue names

Two passive profiles can report the same issue title without satisfying each other's conditions. Keep profile names unique and stable, and test positive and negative exchanges when editing rules.

### Dependency and location

Missing/disabled action profiles cannot execute. Rule files do not embed the referenced profiles. Neither `.bbre` nor Server's profile catalogue is the current rule storage location: use `.bb` files in Pro's `rules` directory.