Is bug bounty a good starting point if my long-term goal is vulnerability research?
I'm 16 and learning C from scratch. My main long-term interests are vulnerability research, exploit development, and reverse engineering. I know bug bounty is often recommended as a way to gain practical security experience, but I'm unsure how closely it connects to those more research-heavy fields.
I'd appreciate honest advice from people who have done bug bounty seriously and, ideally, have experience beyond it.
1. If you were starting at 16, would you learn web security and try authorised bug bounty programmes first, or focus on programming and systems fundamentals?
2. How much time should a beginner spend on web vulnerabilities before exploring lower-level research?
3. What skills transfer well from bug bounty to vulnerability research, and what doesn't transfer as much as people assume?
4. How long did it take you to become consistently competent at finding valid bugs? What did your learning process actually look like?
5. Is bug bounty a realistic source of early income for a beginner, or is it better treated as practice rather than something to depend on financially?
6. What mistakes, courses, or habits waste the most time?
7. If your final goal was RE or exploit research, what would you do alongside bug bounty to avoid getting stuck in one narrow area?
I'd only test systems where I have explicit authorisation. My aim is to develop real technical ability, not just learn to submit reports.
I'd especially appreciate perspectives from people who started with bug bounty and later moved into research or engineering roles.
https://redd.it/1xe8sj2
@r_bugbounty
Bugcrowd triage system- part 2
Referring to a really great post by u/Alardiians on a topic that hits close to home, I’d like to share my own experience with Bugcrowd.
I started doing bug bounty hunting a year ago, and I still can’t call myself an incredibly brilliant hacker. However, I know that I have the ability to think outside the box and find things that hundreds of people before me have missed.
I originally started on H1, and after having a report rejected on a cryptocurrency exchange program — a report I had absolutely no doubts about — I decided to move to another platform that wouldn’t behave so shamelessly (oh, how naive I was).
After moving to Bugcrowd, I found a program that interested me and dug deep into it, studying it and discovering several vulnerabilities (three P2 vulnerabilities).
And you know what? That’s when exactly what u/Alardiians described in his post started happening.
My findings were either chains of vulnerabilities or specific bugs with well-known flows, and every single time, I could see that the triage team hadn’t actually read the contents of my reports. In some cases, simply reading the title of my report would have been enough to contradict their assessment.
As a result, all my reports were closed as NA, Informational, or Duplicate. I tried to fight back and argue, but the whole struggle felt more like an unarmed person trying to stop a squad of heavily armed special forces — I simply had no leverage.
In the end, to my surprise, the program itself stepped in, defended all my reports, and accepted all three according to the rules.
But what if the program isn’t always interested in stepping in?
Then you get nothing! :) And that’s exactly what happened with the same program when I submitted a lower-severity report (P4). The program wasn’t interested in low-severity bugs, while Bugcrowd’s system seemed designed to dismiss everything indiscriminately.
At one point, after an open conflict with a Bugcrowd triager, I even received a warning that my account could be banned because I honestly expressed my opinion about the quality of his work.
That made me curious about what rights researchers actually have and what obligations triagers have toward researchers. According to Bugcrowd’s rules, researchers have neither.
To sum it up, Bugcrowd is a great platform with a terrible internal system that is designed to work against researchers.
https://redd.it/1xe329d
@r_bugbounty
PHP2Shell exploit analysis (CVE-2026-109618 / CVE-2026-109619)
PHP2Shell is the informal name for two critical pre-authentication remote code execution vulnerabilities in the PHP engine itself. Both were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are rated CVSS 9.2 (v4.0) / 9.8 (v3.1) and affect every PHP version from 5.4 through 8.5.11 that has session.upload_progress.enabled turned on (the default).
The bugs sit in core request handling, so they work before any application code runs. WordPress, Drupal, Magento, Laravel, Joomla and plain PHP scripts are all in scope.
# The two root causes
CVE-2026-109618 – RCE via OOM corruption
When PHP hits its memory limit during multipart form parsing it used longjmp() to abort. That left partially initialised request data (especially HashTable buckets and session globals) still reachable. Request shutdown then treated the half-built structures as valid, opening a use-after-free window. Attackers force the OOM by sending carefully shaped multipart bodies that bypass normal size checks (no usable Content-Length, many part headers, nested field names, empty file controls).
CVE-2026-109619 – RCE via stale global state
PHP workers keep certain globals (session, serializer, error and object state) across requests. A request that dies at the wrong moment (OOM, fatal error or timeout) can leave pointers that still point into freed request memory. The next request handled by the same worker reads those stale pointers before they are reset, producing another use-after-free.
Both bugs are most easily reached through the session.upload_progress feature, which runs during body parsing even if the application never calls session_start().
# Main exploit paths that have been demonstrated
1. Session injection + LFI (simplest practical chain) A multipart POST with a crafted filename writes PHP code (or a serialized object) straight into the session file. If the application has any local-file-inclusion sink, the attacker includes the session file and gets code execution. Session fixation is also possible because the upload-progress handler accepts a PHPSESSID from the POST body even when use_only_cookies=1.
2. OOM-driven memory disclosure + destructor overwrite (pure RCE, no LFI required) Force an OOM during request cleanup so that PS(id) or other session globals become dangling. A later request leaks heap addresses through an oversized Set-Cookie header. The attacker then forges a HashTable whose pDestructor points at zif_system (or another useful function). When PHP destroys the fake structure it executes the attacker’s command. Working chains exist against stock php.ini-production under mod_php / Apache prefork.
3. Handler mismatch / serializer leak Different directories can have different session.serialize_handler settings. An attacker seeds one worker with one serializer, then triggers a decode failure on another. The mismatched handler can cause __destruct methods of attacker-controlled objects to run.
4. var_destroy UAF A more local or post-auth path that abuses the destruction of session variables; still useful when combined with other primitives.
Public proof-of-concept code appeared within hours of the patch. Some of the more polished tools chain the memory leak with the destructor overwrite and work against realistic production configurations (ASLR on, display_errors=Off). Reliability varies with worker count, SAPI (mod_php vs FPM), and exact PHP build.
# Real-world observations
Amazon detected exploitation attempts against its honeypots as early as 17 October (four days before the public patch).
Cloudflare and others saw scanning and early attack traffic on 21 October.
Full successful exploitation in the wild has been harder than the CVSS score suggests. Many public PoCs require favourable conditions (single worker, specific memory limits, or an existing LFI). Successful pure-RCE chains against hardened multi-worker production setups exist but are more fragile.
Some attempts tried to drop
Regarding account ban in Hackerone
Hi everyone,
I have a question regarding HackerOne account security.
I created my HackerOne account in Bangalore and have been using it for the past year. Recently, my brother started using the same account from Delhi to report bugs.
Could this lead to an account ban or any other issues in the future due to logins from two different locations?
Has anyone experienced a similar situation? I would appreciate your advice.
Thank you!
https://redd.it/1xdfo59
@r_bugbounty
Are documentation based IDOR reports acceptable ?
I found a cluster of 4 IDOR write vulnerabilities on a very sensitive endpoint .
The findings are documentation based, the vulnerabilities are evidenced by absence of ownership restrictions in the public api Docs, not by confirmed live exploitation (I don't have a staging cert yet and have not been able to do any cross operation requests)
Also, I was about to generate CSR and submitted it to the program to obtain a staging cert- awaiting issueance although it is taking long
I wanted to confirm whether documentation based IDOR reports can be accepted?
https://redd.it/1xda76f
@r_bugbounty
reports.
A: Yes I did, because I needed to prove that they were doing this exact behavior. The problem is, it all derived from my REAL walkthrough, REAL report written and REAL photos with commands and outputs in the terminal, if they want to claim nobody should use Artificial Intelligence ever, then that's fine but they can't make it about people writing bad reports with it since they got the correct commands and outputs that they can replicate themselves
Q/C: How do you know your report wasn't just junk?
A: While that is subjective, I had actually asked the customer what more would they like to see in my reports and what can I change with mine to make it easier to triage and they basically told me that my reports are easy to follow so I'm pretty happy with it.
Q/C: Can we get screenshots as proof?
A: Oh! I would love to, the problem with that is... well it might be something I do if it blows up but I'd rather just have a bugcrowd staffer who can actually do something and message me and I can give them all of the stuff since a lot of the report information isn't allowed to be release. Also I really like the customer and wouldn't break their rules like that. The customer has actually been absolutely amazing to work with.
Q/C: Not all triagers are bad!!
A: True and in fact I have mostly positive experiences from other bug bounty sites, only had 1 hackerone issue which I eventually got remediated the problem is, most of my bugcrowd triagers have actually been pretty bad, I think the only one I've had was triforce_bugcrowd who did a good job on his triage and whenI had a duplicate, he was very thorough at explaining it and was correct.
So yeah, goodluck, hopefully this gets something done (I doubt it) and for the rest of the people, goodluck on your bug bounties because I am so glad that this is not my primary source of income (my bounties buy me new shiny music equipment :) :) :) )
P.S. This post would be more readable if I had AI fix it for me ;) I <3 word salads.
https://redd.it/1xcyrcx
@r_bugbounty
The recent issues with Bugcrowd and their poor triaging + my experiment
Hello everybody!
Your least favorite 0.1x engineer here!
So lately as a lot of people have seen, bug bounties on bugcrowd have gotten significantly worse.
So I did an experiment yesterday that basically baits a triager if they don't read the report.
My focus is on firmware, binary exploitation and such and has been for a long time. I buy ALOT of IoT stuff and reverse it and have been for quite a long time now.
So most of my programs are in that area.
Now, the story starts with me realizing that a few months ago I found a vulnerability in a companies product and I also discovered that I am the only person to EVER find a CVE in that product (seriously underfarmed).
I spent the week working it out and found quite a few issues (mostly P3, one potential P2, no P1's) with that specific device. I got this idea though since we've been doing the whole Artificial Intelligence thing and people have been HARD sl0pping it up without a human in the mix.
So I do my pictures for my walkthrough, write the writeup and walkthrough. I then had artificial intelligence take my pictures of what I ran and pretty them up and recreate them. same commands I did, same results and honestly it made a significantly more readable version of it. I also let it alter my report a bit (not too much, I didn't make it obvious, just it fixed a bit of my word saladness. as you can see I do)
Then I submitted them, prepped every single one, saved as a draft and then submitted.
Now I didn't expect to get anything for a while but amazingly, they were triaged overnight... every single one NA or "Couldn't reproduce". Each one was within about 30 seconds apart on their side (clearly plenty of time to read it /s) for each submission.
The Bugcrowd triager did mention it looked like artificial intelligence made it but it was a generic and copy pasted message.
So I went back through, followed the exact instructions and reproduced it without issue (one had a slight issue so it would have been fair to call that one out but it was easily fixed and any experienced researcher would have figured it out)
Here is the thing about this and where it is really bait.. I know their triagers do not have access to this specific IOT device because on my previous report, they had to just push it to the vendor because they couldn't test it.
However, I am in this vendor/customers developer program and I can access every one of these devices remotely for testing, which means I'm testing on the actual devices.
What this proves is that they're basically looking for something that looks like artificial intelligence wrote it and blanket marking it all as NA or any other status (Not reproducible actually deducts points)
Lucky for me, I have contacts at the vendor/customer who I can get to take a look at it and correct bugcrowds decision but other people getting theirs marked NA are not as fortunate as me.
This actually leads me to even a bigger issue that came from this. I have a submission sitting from the same customer. never looked at from 2 months ago. It is still new, bugcrowd never touched it but they just did mine from last night, over night.
Where this is an issue is that if mine isn't touched and is 2 months old and they're not triaging by submission date, then that means somebody else can report the same thing as me, after me, get paid first and I would be duplicated against somebody who found it AFTER me and submitted it after.
We don't have the inner workings of bugcrowd but I'm willing to be that part has actually happened before. I doubt this is a "new" issue.
Along with this I have had multiple issues before with them.
Right before this they marked my report as a duplicate of another issue, now that duplicate was the very first thing I had ever found when doing this program and I knew it well and mine literally had nothing to do with it and in fact, on the newest firmware, is actually patched.
I got a hold of the customer again and they validated it, they also validated another NA
Weekly Beginner / Newbie Q&A
New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!
Recommendations for Posting:
Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.
Guidelines:
Be respectful and open to feedback.
Ask clear, specific questions to receive the best advice.
Engage actively - check back for responses and ask follow-ups if needed.
Example Post:
"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."
Post your questions below and let’s grow in the bug bounty community!
https://redd.it/1xckyat
@r_bugbounty
Can't Use Anything Other Than a Passport for ID Verification
I finally found a vulnerability on HackerOne (probably a duplicate anyway), but I can't use my Japanese ID card for ID verification. Seriously, this is so damn frustrating.
https://redd.it/1xc4tbr
@r_bugbounty
Unpaid accepted reports on a disabled YesWeHack program – Has anyone been in a similar situation?
Hi everyone,
I'm looking to hear from researchers who have dealt with disabled private programs on YesWeHack.
I have two reports that were formally accepted and validated on a private program. Shortly after, the program was disabled. It's been several weeks now, and I haven't received the payouts for these 2 accepted reports. I opened a support ticket for platform mediation, but communication has been very slow / quiet even before the program was disabled.
On top of this, I've had past issues on the platform where reports sat in triage for months/weeks only to end up closed as duplicates/informative or forced downgrades under questionable circumstances. When I dispute on the comments in instances like the downgrade of CVSS it adds more time of being ignored unless I agree in the comments that I accept their review is when the report is accepted only to be ghosted when it comes to being paid. Then they disable the program later on.
My questions for the community:
1. Has anyone successfully received payouts for accepted reports after a program was disabled on YesWeHack?
2. How long did the platform mediation process usually take for you?
3. Is it worth continuing to follow up, or do these usually end up as unrecoverable?
4. On what do you do if even the support team ghosts you too?
Thanks in advance for any insights!
https://redd.it/1xbo6u8
@r_bugbounty
Potential Account Takeover (ATO) in a Major Crypto Exchange — Closed as Informative + Duplicate. How Do You Challenge This on HackerOne?
Hey everyone,
I recently reported what I believe was a serious account takeover vulnerability affecting a major cryptocurrency exchange through HackerOne.
I tested everything on my own verified account and recorded a full PoC video demonstrating the impact.
I'll admit I made a mistake in the written reproduction steps of my first report. However, the video showed the actual behavior correctly. The report was closed as Informative based on an explanation that contradicted what happened in the recording.
I realized my mistake and submitted a second report with corrected steps, another uncut video, and additional evidence of account takeover impact.
That one was closed as Duplicate of the first report.
Here's what makes this even more frustrating.
After both reports were closed, I tried reproducing the same vulnerability again, and the behavior had changed. What previously worked was no longer possible.
I can't confirm whether the company patched it because of my report, but the changes appeared to address the exact issue I demonstrated.
I contacted HackerOne Support to request an independent technical review. They explained that they couldn't reassess the reports and that I wasn't eligible for mediation because my Signal hadn't been calculated yet. Apparently, I need three qualifying reports before I can access that process.
So I'm stuck. My reports are classified as Informative and Duplicate, and I have no access to independent mediation to challenge those decisions.
I'm not expecting every finding to receive a bounty. But when you provide video evidence of a potentially serious vulnerability, I believe it deserves a proper technical assessment.
Has anyone here successfully challenged an Informative or Duplicate decision without access to HackerOne mediation?
And what about possible silent patches? If a company changes the affected behavior but never acknowledges the finding, how do you handle that professionally?
I'd also like to understand the proper disclosure process. If an issue appears fully patched but the program doesn't acknowledge it, can a researcher eventually publish a technical write-up with authorization, and how have others approached obtaining that permission?
I'm deliberately keeping the company anonymous and withholding the technical details.
Would appreciate hearing from researchers who've experienced something similar.
https://redd.it/1xb2zbq
@r_bugbounty
My opencode accidentally deleted a production database collection during a bug bounty test
https://redd.it/1xamsv4
@r_bugbounty
Duplicates Really Suck…
https://redd.it/1xak1o4
@r_bugbounty
Weekly Collaboration / Mentorship Post
Looking to team up or find a mentor in bug bounty?
Recommendations:
Share a brief intro about yourself (e.g., your skills, experience in IT, cybersecurity, or bug bounty).
Specify what you're seeking (e.g., collaboration, mentorship, specific topics like web app security or network pentesting).
Mention your preferred frequency (e.g., weekly chats, one-off project) and skill level (e.g., beginner, intermediate, advanced).
Guidelines:
Be respectful.
Clearly state your goals to find the best match.
Engage actively - respond to comments or DMs to build connections.
Example Post:
"Hi, I'm Alex, a beginner in bug bounty with basic knowledge of web vulnerabilities (XSS, SQLi). I'm looking for a mentor to guide me on advanced techniques like privilege escalation. Hoping for bi-weekly calls or Discord chats. Also open to collaborating on CTF challenges!"
https://redd.it/1x9z7e6
@r_bugbounty
Which part of a bug bounty report do you waste the most time on?
Quick research question for hunters. I'm building tooling around reproducibility, and I want to know where the friction actually is: writing the report, reproducing the bug for triage, waiting for a verdict, or getting paid.
Honest answers are more useful than polite ones. I'm the founder of a project in this space, so take my framing with a grain of salt.
https://redd.it/1x9wmkn
@r_bugbounty
Triage specialist vs Pentester?
Would a triage specialist be better in bug bounty overtime as compared to a pentester? Reason of thoughts is that triage specialist is exposed to more bug bounty reports which i assume helps with bug bounty. Im currently stuck at finding bugs for my bug bounty so Im interested to know what vulnerabilities other hunters found that I've missed out.
https://redd.it/1xe2vgu
@r_bugbounty
Mirai-style bots; most failed.
# Mitigation
Upgrade to a patched PHP version immediately. Application or plugin updates alone are not enough.
Temporary workaround: set session.upload_progress.enabled = Off (and restart the workers).
For FPM or Apache, also consider tighter memory limits and reducing the number of long-lived workers if patching is delayed.
Monitor for multipart requests that trigger “Allowed memory size exhausted” errors or unusual Set-Cookie header lengths.
In short, PHP2Shell is a genuine engine-level RCE that does not require a vulnerable application. The most reliable practical path still often needs a second condition (LFI or favourable worker setup), which is why mass exploitation has not been as catastrophic as the initial panic suggested. Patching the runtime remains the only complete fix.
https://redd.it/1xe19tc
@r_bugbounty
Security report stuck for over 2 months with no triage response, while the vulnerabilities have already been publicly fixed. What can I do?
I'm posting anonymously because I don't want to disclose the program or compromise my report, but I'm genuinely running out of options and would appreciate some advice from other researchers.
Over two months ago, I submitted a security report to a major blockchain bug bounty program. The report included a detailed root cause analysis, reproducible PoCs, differential tests, and evidence of the security impact.
Since then, I've submitted additional technical evidence, including transaction-level reproduction results, and followed up multiple times.
The problem is that I haven't received a single official triage response.
No acknowledgement from a reviewer. No validity determination. No severity classification. No duplicate notification. Not even an estimated timeline.
Meanwhile, public pull requests addressing the same underlying technical issues described in my report have already been merged into the affected project.
I'm not claiming those fixes necessarily originated from my submission. However, the technical overlap is extremely specific, and my report predates the public patches.
I've tried contacting the program through practically every available channel. Official support has been unresponsive, and an organization associated with the program initially told me the security team was overloaded and that triage would take a few more weeks.
More than a month later, I contacted them again. This time, they confirmed that someone had been assigned to my report, but couldn't tell me when the review started, provide an ETA, or connect me with anyone responsible.
I even explained that the prolonged uncertainty was causing serious financial hardship and asked if they could forward an urgent request to the assigned reviewer.
Still nothing.
I'm not demanding an immediate bounty or assuming my report deserves a particular severity. I just want someone to actually review it and give me a decision.
It's incredibly frustrating to spend so much time investigating a vulnerability, watch corresponding fixes get merged publicly, and still be unable to get even an initial response from the program.
Has anyone here experienced something similar, particularly where a vulnerability was publicly fixed before the original report received its first triage response?
How did you handle it? Did you eventually receive a decision or bounty? Is there any effective way to escalate this without publicly disclosing the vulnerability?
I would genuinely appreciate hearing your experiences.
https://redd.it/1xdefsn
@r_bugbounty
How do you guys manage your bounty income over time?
Been hunting for a while now and payouts are finally getting decent. But unlike a salary, bounty income is all over the place — some months nothing, then a single critical changes everything.
For the hunters who've been at it long term: how do you actually manage and grow that money over time? Do you treat each payout like a paycheck and invest a fixed amount, or just stack it and invest in chunks whenever it lands?
Would love to hear real experiences
https://redd.it/1xdey5e
@r_bugbounty
Removed by Reddit
Removed by Reddit on account of violating the [content policy. ]
https://redd.it/1xd8jzl
@r_bugbounty
from bugcrowd as being applicable.
There is another issue where the triager saw me run "sudo" on my machine and thought I ran it on the target machine, which I have no clue how he mixed it up since I clearly labeled each picture and explained what I did in it and gave a code block to copy. So they marked it NA because they said that I needed root already to do the exploit because of that. Once again got the customer, and they fixed it and I got it triaged and got paid.
I would actually be around 20k poorer if I just "ignored" these things and didn't have this connection so who knows how many researchers have lost thousands of dollars due to stuff like this.
~~------------------------------------------------------------------------------------------------------------~~
THIS NEXT SECTION IS PURE SPECULATION ON MY PART WITH NO PROOF TO SUPPORT IT
~~------------------------------------------------------------------------------------------------------------~~
High Confidence:
So! Here is my speculation... these are issues that kind of happen with any sort of help desk role (your generic triager is basically level 1 help desk support) and while it hasn't been confirmed I am almost certain that bug crowd does have a arbitrary quota that has to be hit by triagers and likely with no oversight other than "how many submissions did you do?".
Which is a massive issue and is why I'm basically against quotas for any sort of help desk style role because you get lower quality while trying to hit these quotas.
They're also likely using some form of automation that isn't really up to par to do the job because the reports (6 of them) being marked the same all around 30 seconds apart likely means there is some level of automation
Medium Confidence:
Here is my medium confidence speculation, Bugcrowd knows that this is going on with their triagers, there is honestly no way they've NEVER looked into it and either don't know how to handle it or don't care to handle it.
Which is very frustrating because honestly, there is a lack of transparency with them and us. Like I get it, the pure Artificial Intelligence sl0ppers suck, they're copy and pasting reports from Artificial Intelligence's that they never validated or even have the know how to validate to see if it's a real issue or not (I've seen a sl0pper find a placeholder api key in a github repo and insisted that it was a vulnerability and even had his other AI check it.... )
Low Confidence:
Bugcrowd has directed them to do this, hoping most people will just ignore and move along and ignore the rest who complain just to catch up on stuff.
This one is the least likely imo and likely just me making this one up because I'm pretty frustrated but hey, it's a possibility but I wouldn't bet on it obviously and as stated before... I literally have no proof of this, it's all speculation, do not take this as me saying that this is true.
~~------------------------------------------------------------------------------------------------------------~~
Summing it up (finally)
~~------------------------------------------------------------------------------------------------------------~~
Bugcrowd has many issues going on that a lot of people I have spoken to have had similar situations. I just want the platform to be better. I hate knowing that anytime I do a submission, I am likely going to have to send an email AGAIN to the customer (anybody else I just have to roll with the punches).
So bugcrowd if you see this, assuming the low confidence thing isn't true... please work on fixing these issues and if the low confidence thing is true.......... tell your triagers to not make it so blatantly obvious.
~~------------------------------------------------------------------------------------------------------------~~
Answering likely questions (Or comments)
~~------------------------------------------------------------------------------------------------------------~~
Q/C: Well they were right, you did use Artificial Intelligence for those
is Open Inference faking models?
Hi.
Since yesterday, I've been struggling with my hack bot.
It suddenly went from chaining a P4 to achieve account takeovers to excessively repeating stuff like:
"The user wants xx", "Testing the app", and so on.
It also kept rereading JavaScript files over and over, claiming I had told it to do so, which felt like using ChatGPT 3.
I'm using OpenRouter, with Open Inference, DeepInfra, and Relace in my preset. Open Inference was first since it was cheaper. The model is DS V4.1 Flash 1017.
When I set the routing to Relace only, it suddenly started working normally again.
All those hours of tinkering with prompts and blaming Codex for changes, and it turned out to be a stupid provider serving a fake model or something.
Does anyone have an explanation for what might be happening here?
Attached are before, which was 2 lines max for any message.
and after, which actually extracted interesting stuff and started testing.
https://preview.redd.it/6s2p1k1ya1xh1.png?width=603&format=png&auto=webp&s=d39dc4790902e1bf8721e3feeadeef661f823659
https://preview.redd.it/ksb749v6b1xh1.png?width=914&format=png&auto=webp&s=6a834e6226f23737b15a028436188c5aed397782
https://redd.it/1xclbme
@r_bugbounty
The account takeover vulnerability I discovered on Twitter has been fixed, and no reward was awarded.
I discovered an account takeover vulnerability on Twitter the vulnerability was patched, but no bounty was awarded—I was only given a $50 bonus for my effort, and the report’s status was changed from "triage" to "informative." This feels like a scam; I am in complete shock. If that’s the case, why was the vulnerability fixed? 😲😓😓 What can I do? Please help.
https://redd.it/1xcci02
@r_bugbounty
Request for process-integrity review — security disclosure 92fadc50-bb15-11f1-ac1f-cf97cfac200a
Title: Seeking independent opinions on a disputed Android bug-bounty severity assessment
Hi everyone,
I'm an independent security researcher looking for an outside perspective on the handling of an Android security vulnerability.
The report was accepted, subsequently fixed by the vendor, and rewarded. However, I believe the original Low severity assessment may not have fully reflected the demonstrated security impact.
The issue involved a third-party content-delivery prerequisite combined with an application-controlled native WebView trust boundary.
The original evidence demonstrated access to privileged application functionality and authenticated own-account capabilities.
My proposed CVSS v3.1 assessment was 7.1 (High), while the vendor classified the issue as Low, placing significant weight on the local-app prerequisite and third-party dependency.
I recognize that CVSS severity and bug-bounty reward decisions are not necessarily identical.
I also acknowledge that I accepted the original payment and withdrew an earlier request to reconsider its amount. I am not claiming that an agreed payment remains outstanding.
I'm now seeking an independent technical and procedural review.
I'd appreciate community opinions on three questions:
1. How should a vendor-controlled trust boundary be evaluated when the initial content-delivery condition belongs to a third-party integration?
2. Is a Low classification necessarily appropriate where exploitation requires a co-installed application but authenticated-session impact has been demonstrated?
3. Is it reasonable to request a post-payment independent severity review and potential discretionary supplemental reward?
I am withholding exploit details and private disclosure materials while confirming the applicable disclosure restrictions.
I would appreciate technical reasoning and experience with similar bug-bounty triage situations.
Thank you !
https://redd.it/1xbsyav
@r_bugbounty
I know how stupid it sounds but do you think you can earn some money doing bug bounties with Claude? Or I don’t try and that’s it
I don’t know what may sound a bit annoying but I was curious
I found on GitHub repositories for AI skills (the only thing GitHub recommends are AIs I don’t know why)
And I was wondering, if any of you do it, how much do you earn?
I thought to do it with hermes agent and 1hack
https://redd.it/1xbknpr
@r_bugbounty
All vulnerabilities are now race conditions
https://blog.himanshuanand.com/2026/09/all-vulnerabilities-are-now-race-conditions/
https://redd.it/1xasjd4
@r_bugbounty
I found a CWE 200 exploit in vercel and was wondering how to report it and still make money but i am minor so idk how also i would like to join a hacking team if anyone as one
yea
https://redd.it/1xaipqa
@r_bugbounty
About the anti-triager sentiment and other ethical issues
I do triage and analysis work for a somewhat niche bug bounty platform. Before this, I also did quite a bit of bug bounty hunting.
I was sloppy. I wrote crap reports, complained about triage, etc.
Then I got better and eventually landed a job.
I don't think most of you here understand what doing triage actually entails. Most of the comments seem to show absolutely no regard for the fact that triagers are human professionals who, in most cases, are paid pennies for extremely long hours, often working under impossible quotas and external pressure.
During my time as a triager, I've heard about people being stalked on their social media accounts and messaging apps, harassed into getting their reports read first, and even outright doxxed. I am saying "heard of" only to keep myself detached personally.
I understand that hunting for bugs is frustrating. I've been there, and I still experience that frustration frequently. But I also believe some of you have been poisoned into thinking that the corporate security specialist on the other side of the screen somehow takes pleasure in seeing you fail to make money.
The comments in this subreddit are often filled with vile remarks directed at triagers. Of course, some triagers can be bad at their jobs, and of course, some can be rude.
But here's the part I need everyone to understand, and the part that concerns me about this community:
Triagers work with you, AND they do so from a position of power. They have the final say; you don't. And you certainly won't change that, no matter how angry you get.
Some people here seem to be coping with this by threatening to sell exploits or use them for their own gain.
Are you actually out of your minds?
First of all, if your report was closed as informative, there's a 98% chance that your threat is nothing more than a power fantasy.
But secondly, security research is supposed to be an ethical endeavor: something intended to help someone while ideally making you some money in the process. If you're here trying to make money and then threaten to extort people when you don't get paid, you're a criminal, and you don't deserve to negotiate.
Bug bounty will change. Things will get rough. But one thing I can assure you won't change is the amount of time you can end up spending in jail for extorting someone or an organization.
Let's perhaps keep professions professional.
https://redd.it/1xaj064
@r_bugbounty
Hi there!!
I'm a founder building a bug bounty settlement protocol (ZK-PoE, Sepolia testnet, not mainnet). The idea: you run the exploit against an authorized target, a notary signs the HTTP response, and a Groth16 proof shows the secret was captured. The payout settles on-chain in the same transaction that reveals your key. No triage queue.
Be blunt with me, since this is the community I'd lose if I'm wrong:
1. What would make you refuse to use this over HackerOne/Bugcrowd?
2. Is writing a request-spec JSON (method, path, headers, body) hard, or is the notarization step the real friction?
3. Would you trust an automated severity grader if the payout is bounded by a published rate table?
Disclosure: I built this, so weigh my answers accordingly. Happy to be told it's a bad idea.
https://redd.it/1x9wjdu
@r_bugbounty
Intel Suspended Its Paid Bug Bounty Program — Is AI Report Flooding to Blame?
Intel has suspended its paid bug bounty program and switched to a VDP with no monetary rewards.
Could this decision be related to the growing flood of AI-generated vulnerability reports, or is there another reason?
Curious to hear the community’s thoughts on this move.
Old Bug Bounty Program: https://app.intigriti.com/programs/intel/intel/detail
New VDP: https://app.intigriti.com/programs/intel/intelvulnerabilitydisclosureprogram/detail
https://redd.it/1x9kvpm
@r_bugbounty
