> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/validation.md).

# Validate and distribute saved profiles

Reopen, test and distribute the profile generated by Pro.

## Save and reopen in Pro

1. Finish the profile in Burp Bounty Pro's graphical editor and click **OK**.
2. Confirm its name, type, tags and enabled state in the profile table.
3. Reopen it with **Edit** and check payloads, insertion points, grep conditions and issue details. For multi-step profiles, review every step.
4. Keep a recoverable copy of the generated `.bb` file before further changes.

Pro generates the JSON. Validation starts with the saved profile; writing field arrays by hand is not a prerequisite.

## Validate behavior

| Fixture                | What it should establish                                                      |
| ---------------------- | ----------------------------------------------------------------------------- |
| Positive               | The intended input produces the expected evidence.                            |
| Negative               | A normal response does not match.                                             |
| Near-miss              | Similar text in another header/body/component is not mistaken for the signal. |
| Authentication failure | A login/error page does not masquerade as a vulnerability.                    |
| Multi-step failure     | A failed prerequisite prevents the later step/report.                         |
| Control                | The signal disappears or changes as the hypothesis predicts.                  |

Inspect the actual transmitted request, encoding, redirect chain and issue data. Test on the engines you intend to support. Record whether validation was structural, offline behavior, or an authorized live test; do not call all three tested without distinction.

## Distribute the generated file

1. Copy/export the complete saved profile with its payload and grep rows.
2. Load it into another Pro data directory, or place it in the Server catalogue directory.
3. Reload Pro's files or query Server `list_profiles` again.
4. Confirm the exact name, scanner type, enabled state and tags before using it.

Pro's Server Scanner sends selected profiles with the scan, so that workflow does not require a separate catalogue installation. An MCP inline profile belongs to that submission and does not install a file in the catalogue.

Keep credentials, session cookies and machine-specific paths out of reusable examples. The [example assets](/creating-profiles/examples.md) can be opened and edited in Pro. Their reflection/error signals are not proof of exploitable impact without further verification.

## Optional technical checks on an export

For pack maintainers and integrations, the **burp-bounty-profiles** skill includes an offline linter:

```bash
python3 /path/to/burp-bounty-profiles/scripts/validate_profiles.py exported-profile.bb
python3 /path/to/burp-bounty-profiles/scripts/validate_profiles.py --marked exported-profile.bb
```

The script sends no traffic. `--marked` checks compatibility with Server's exclusive insertion mode. A successful lint does not prove detection or regex equivalence.

The skill also includes an optional Go helper using the actual Server converter/matcher. These checks inspect generated files; they are separate from creating a profile in the editor. MCP `create_scan` is never a dry-run or schema probe.