I've been poking at web apps for a while now, and I need to say something that'll probably annoy people who make money off bug bounties.

Most of it is the same five bugs.

Not similar bugs. Not "bugs in the same family." The same bugs. Same logic, same mistakes, same missing checks, copy-pasted across a thousand different products by a thousand different teams who all think their situation is unique.

The reason this matters is that the industry — bug bounties, pentest firms, the whole "become a hacker" content ecosystem — sells web testing as a hunt. A treasure hunt. You against the codebase, finding what nobody else could find. And that framing is a lie. What you're actually doing, most days, is walking the same hallway and trying every door handle in the same order, and every once in a while one of them is unlocked.

Let me back up, because if you're new you probably don't believe me.

The five bugs

There are five bugs. Everything else is a variation.

Broken access control. This is the big one.…