Introduction: The Critical Oversight in Bug Bounty Programs

Publicly exposed credentials, such as API keys and tokens, represent an immediate and actionable threat akin to leaving a high-security vault unlocked with its access code openly displayed. These credentials, often granting administrative privileges, bypass traditional exploit requirements, providing direct access to critical systems. Despite their gravity, official bug bounty programs systematically categorize such findings as “Out of Scope,” due to a fundamental misalignment between their vulnerability-exploit-impact models and the nature of credential exposure.…