#Bugbounty

Would a triage specialist be better in bug bounty overtime as compared to a pentester? Reason of thoughts is that triage specialist is exposed to more bug bounty reports which i assume helps with bug bounty.…

PHP2Shell is the informal name for two critical pre-authentication remote code execution vulnerabilities in the PHP engine itself. Both were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.…

I'm 16 and learning C from scratch. My main long-term interests are vulnerability research, exploit development, and reverse engineering. I know bug bounty is often recommended as a way to gain practical security experience, but I'm unsure how closely it…

Over the last couple of months I’ve seen so many researchers getting banned from HackerOne because of duplicate accounts. Even some top bug hunters got hit.…

I have submitted a reprot on 7 october Critical then downgrade to high on 8 October without any feedback. Still triage until today without any news I have the same thing critical sql injection downward to medium servity as intern Need help from support or…

It really has got to the point now where it is very unusual for one of the reports I log to actually get a payout within the programme's published scope.…

I found a cluster of 4 IDOR write vulnerabilities on a very sensitive endpoint . The findings are documentation based, the vulnerabilities are evidenced by absence of ownership restrictions in the public api Docs, not by confirmed live exploitation (I…

Hi everyone, I have a question regarding HackerOne account security. I created my HackerOne account in Bangalore and have been using it for the past year. Recently, my brother started using the same account from Delhi to report bugs.…

I'm posting anonymously because I don't want to disclose the program or compromise my report, but I'm genuinely running out of options and would appreciate some advice from other researchers.…

Been hunting for a while now and payouts are finally getting decent. But unlike a salary, bounty income is all over the place — some months nothing, then a single critical changes everything.…

I reported a bug in iOS 27 last month, within 11 days they planned it for fix in fall this year, but i added some impact escalation followups, they again flipped the status to reviewing and no comment on report. Is this normal?…

We have fixed issue in our software back in June, and we wanted to obtain CVE-IDs for those issues. We submitted our request through https://mitre.github.io/mitre-cve-roles/cve-id-request/#cvePortal but haven't had the slightest reaction since then, not…

Edit: Hey everyone. I previously sent a report with an issue of BAC with privilege escalation, submitted it on 23rd August. It got reviewed on 5th September but marked as N/A all theoretical with no impact but if I believed it to be real then I could send…

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here! Recommendations for Posting: Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource…

After months of grinding and bug bounty politics, i finally got my recognition as a pre degree student. Originally my vuln got downplay by a program manager despite being in scope and agreed by platform triager.…

As far as I calculated, I should be able to submit reports without waiting for the triaged one to be processed according to their new documentation. Can anyone confirm if this is working as intended or something is wrong.…

Hey everyone, hope youre fine A few months ago, I reported a vulnerability on Bugcrowd. It was marked as a duplicate of another report involving a different vulnerability.I explained that my finding was unrelated to the other report, but never received an…

It seems like mostly when report looks ai type triage report it as n/a, there was once a triager who asked me for an edit and i did the edit then when i submitted followup, another weird tirager seemed like he is replying to different report, what you…

(Disclosure: I work at Gray Swan, where I run the Frontier Lab Safety team and the Arena) We just launched our largest-ever AI red teaming challenge, at the request of Anthropic, Meta, Google DeepMind, Reflection, and our other lab sponsors, who want to…

I need advice from experienced bug bounty hunters about a report that was closed as Informative despite my attempts to explain the attack scenario and demonstrate the security impact.…