A. M. Alogo Situmorang·1d agoWhat the UI Hides, the API Tells: How I Found Mass Data Exposure in a Live Chat FeatureChaining guest JWT tokens, missing rate limits, and verbose JSON responses to land my second bug bounty reward.
L4ZZ3RJ0D·3d agoHow a Guessable Number Exposed Every Meta AI User’s Private PromptsStarting the AI side of this series with one that genuinely deserves the spotlight. Found by Sandeep Hodkasia, founder of AppSecure…
Dhiren Kumar Pradhan·4d agoThe JWT Bugs That Survive ‘We Use OAuth, So We’re Secure’Algorithm confusion, JWKS trust failures, and the cross-tenant mistakes I keep finding in production APIs
abdelnasser·Nov 3One-Click Account Takeover via WebView Auth Header Injection to Claimable Whitelisted Domainبِسْمِ اَللَّهِ وَالْحَمْدِ لِلَّهِ الَّذِي عَلَّمَ بِالْقَلَمِ عَلَّمَ الْإِنْسَانَ مَا لَمْ يَعْلَمْ وَالصَّلَاةَ وَالسَّلَامَ عَلَى…
Avinash Kumar·Nov 3[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes RemotelyHi everyone!A response icon2A response icon2
Isv0x1·Nov 2Cross-Site Scripting (XSS) via Malicious GIF Cyshield CTF 2026In my previous writeup, we explored the first CYSHIELD CTF 2026 challenge, focusing on a 2FA authentication flaw.
starkwizzer·Nov 2Killed by a Browser, Revived by a BackslashSingle Quote Turned a Dead Bug to Full JS Control over NASA.govA response icon1A response icon1
InMeetCyberbyGopal Rajguru·Oct 31Your AI Coding Assistant Will Run Whatever Its Config File Says[bug bounty hunters and appsec engineers] This month, a single trailing dot in GitHub Copilot’s own security prompt was turned into a…
Killua199·Oct 30Bypassing Organization-Wide 2FA Enforcement with a Single API Requestالحمد لله الذي عَلَّمَ بالقلم.. عَلَّمَ الإنسانَ ما لم يَعْلَم والصلاةُ والسلامُ على خيرِ مُعَلِّمي الناسِ الخير محمد أما بعد
AstroKrypTech·Oct 30Bug Bounty Case Study: How a Public ID Exposed Private Account EmailsGetting a valid UUID
![[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes Remotely](https://miro.medium.com/v2/resize:fill:160:106/1*BnUqWuLxIdDhHDLlp1HmdA.png)
![[$10,000] Google Jules — The Silent Code Heist - Stealing Github Codes Remotely](https://miro.medium.com/v2/resize:fill:320:214/1*BnUqWuLxIdDhHDLlp1HmdA.png)
