Bug Bounty
A bug bounty program is a deal offered by organizations and software developers by which individuals can receive recognition and compensation for reporting security vulnerabilities. These programs have become a critical component of modern security strategies, with platforms like HackerOne, Bugcrowd, and Intigriti connecting thousands of researchers with companies that want their products tested.
Bug bounty hunting requires a broad skill set — from reconnaissance and attack surface mapping to deep technical knowledge of specific vulnerability classes. Successful hunters understand not just how to find bugs, but how to demonstrate impact, write clear reports, and communicate effectively with security teams. The difference between a duplicate and a high-severity payout often comes down to the depth of investigation and quality of the proof of concept.
The bug bounty ecosystem has matured significantly. Programs range from public programs open to anyone to private, invite-only programs for experienced researchers. Payouts vary from a few hundred dollars for low-severity issues to six-figure rewards for critical vulnerabilities in high-value targets. Many researchers treat bug bounty as a full-time career, while others use it to sharpen their skills alongside traditional security roles.
Key topics include choosing targets, managing scope, avoiding duplicates, writing effective reports, and understanding triage processes across different platforms.
This page collects bug bounty resources, methodologies, success stories, and guides for both beginners and experienced hunters.
From Wikipedia
The skills that decide bounty outcomes are mostly not technical
People arrive at bug bounty assuming the constraint is knowing enough vulnerability classes. Usually it is not. The constraint is target selection, persistence on one application long enough to understand it, and writing reports that a triager can validate quickly. Plenty of technically capable testers earn very little because they spend their time on the same wide-open, heavily-hunted programs as everyone else, and report findings in a form that takes a triager an hour to reproduce.
Target selection compounds more than any other decision. A newly launched program, a recently expanded scope, or an acquisition folded into an existing scope all have unhunted surface; a mature program that has been public for four years mostly does not. Reading the scope and the changelog carefully is not administrative overhead, it is where the expected value is decided.
Depth beats breadth on any target worth returning to. Testers who do well on a single program tend to have modelled it — they know the roles, the tenancy boundaries, which services are internally developed versus bought, what the mobile client does that the web client does not, and where the legacy endpoints are. That model is what lets you notice that a new feature reuses an old identifier scheme. Automated recon supports this by telling you when something changes, which is a different job from finding bugs directly.
On reports: include the exact request, the precise impact, and the shortest reproduction that demonstrates it. Severity arguments are won with a clear account of what an attacker gains, not with adjectives. Duplicates are a structural feature of the model rather than a personal misfortune, and the main defence is hunting where fewer people are looking.
The collection below mixes disclosed reports, methodology and program mechanics. The disclosed reports are the most instructive material on this site — read them for how the tester decided where to look, not just for the bug.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-11-04 NEW 2026 | Finding 40+ Vulnerabilities in Healthcare Software Serving More Than 100 Million Patients news | A security researcher discovered over 40 vulnerabilities in healthcare software used by more than 100 million patients. The specific types of vulnerabilities and their impact are not detailed in the title. The content does not mention any bug bounty payout amounts. |
| 2026-11-04 NEW 2026 | Intent Redirection to One-Click Account Takeover (But It’s a Duplicate) news AuthN | This report details an intent redirection vulnerability that could lead to a one-click account takeover. However, the vulnerability was ultimately classified as a duplicate. No bounty payout amount is mentioned in the provided content. |
| 2026-11-04 NEW 2026 | How a Single Leaked Client Secret Exposed a Private GitHub Repo beginner Secrets | A leaked client secret, hardcoded in a JavaScript bundle, allowed an attacker to gain full admin access to a private GitHub repository. This case study highlights how a single credential exposure can lead to significant security breaches through exploit chaining. The vulnerability demonstrated a critical path from seemingly minor code oversight to complete repository compromise. |
| 2026-11-04 NEW 2026 | A Database With the Front Door Left Open: Misconfigured Firebase Security Rules beginner AuthZ | A misconfiguration in Firebase security rules left a database exposed, akin to leaving the front door open. This vulnerability allowed unauthorized access to sensitive data. The specific bounty payout for this finding was not mentioned in the provided content. |
| 2026-11-04 NEW 2026 | Will AI Kill the Bug Bounty Industry? news AI | AI's increasing speed in finding bugs is overwhelming security teams, threatening the bug bounty industry by 2026. Previously, bug discovery was the main challenge, but AI's efficiency now inundates researchers and companies alike. This technological shift necessitates adaptation within the industry to avoid collapse. The article explores how the bug bounty landscape is evolving to address this AI-driven surge in security findings. |
| 2026-11-04 NEW 2026 | Shanti Se Poocho AI: Potential API Credential Disclosure news AI API Sec | A security researcher, Het Mehta, reported a potential API credential disclosure vulnerability in Shanti Se Poocho AI on November 3, 2026. The report details a specific bug bounty program for responsible vulnerability disclosure. The title explicitly states the issue: "Potential API Credential Disclosure." The content provided does not mention a specific bounty payout amount. |
| 2026-11-04 NEW 2026 | Container Escapes and Linux Privilege Escalation: How They Work and How to Shut Them Down beginner AuthZ | This content explores how misconfigurations can allow container escapes to the host system and lead to Linux privilege escalation. It details the vulnerabilities that enable these escapes and the single crucial check that can detect each instance. The article then outlines the necessary fixes to prevent such security breaches, ensuring a more secure containerized environment. No specific bounty payout amounts are mentioned. |
| 2026-11-04 NEW 2026 | Intigriti XSS Challenge: Beyond the Sanitizer intermediate XSS | This content describes the Intigriti XSS Challenge, focusing on techniques to bypass sanitizers and achieve Cross-Site Scripting (XSS) vulnerabilities. It details a specific vulnerability discovered in a custom sanitizer that allowed for XSS execution by exploiting a logic flaw. The challenge aims to educate participants on advanced XSS exploitation methods beyond basic input filtering. The summary does not include a bug bounty payout amount as none was explicitly stated in the provided content. |
| 2026-11-04 NEW 2026 | One-Click Cookie Theft via Deep Link XSS (But Deep Links Are Out of Scope) intermediate XSS | This document details a "one-click" cookie theft vulnerability discovered through Cross-Site Scripting (XSS) in deep links. The exploit allows attackers to steal user cookies with a single click. However, the content explicitly states that deep links are considered out of scope for bug bounty programs, meaning this vulnerability may not be eligible for any bounty payout. The summary highlights the technical nature of the vulnerability and its exclusion from typical reward programs. |
| 2026-11-03 NEW 2026 | The Binance Hack Raises a Critical Question: What Can a Compromised Laptop Reach? news 2 min read Secrets | Analysis of the Binance hack, which reportedly caused $6.3 billion in losses, highlights the critical security risk posed by compromised developer laptops. Attackers can leverage credentials like API keys, cloud tokens, and SSH keys stored locally to achieve lateral movement into cloud infrastructure, internal services, and production systems. Security teams must proactively discover and manage these credentials on developer workstations, removing unnecessary plaintext copies and minimizing privileged access to limit the blast radius of an endpoint compromise. → blog.gitguardian.com |
| 2026-11-03 NEW 2026 | Bug bounty hunters: Have you found security bugs in AI-generated web or mobile apps? beginner AI AuthZ Mobile | This post explores the security implications of AI-generated web and mobile applications, using an example of an iPhone app created with Codex. The author, new to Swift, built the app and is now curious about its security vulnerabilities. The content prompts bug bounty hunters to share their experiences and findings regarding security bugs in AI-generated applications, indicating a potential new frontier for bug hunting. |
| 2026-11-03 NEW 2026 | How I Found My First Bug: Information Disclosure via Exposed Directory Listing beginner | This article details a bug bounty hunter's discovery of their first vulnerability: an information disclosure through an exposed directory listing. During the reconnaissance phase of a bug bounty program, the hunter identified an accessible directory that inadvertently revealed sensitive files and configurations. This overlooked directory, often missed during automated scans, provided unauthorized access to potentially critical data. The vulnerability highlights the importance of thorough manual reconnaissance in identifying security weaknesses that might otherwise go unnoticed. The author does not mention a specific bounty payout amount. |
| 2026-11-03 NEW 2026 | The Bridge Between a Web Page and the Phone Itself: Abusing an Android WebView JavaScript Interface intermediate Mobile | This content likely discusses a security vulnerability within Android's WebView component. It explains how a JavaScript interface, intended to allow web pages to interact with the native Android application, can be exploited. Attackers could potentially leverage this bridge to gain unauthorized access to device functionalities or sensitive data that the web page should not be able to reach. The summary would focus on this vulnerability, the mechanism of abuse, and the potential consequences for user security. No payout amount is mentioned. |
| 2026-11-03 NEW 2026 | Killed by a Browser, Revived by a Backslash intermediate | A researcher discovered a critical bug that granted full JavaScript control over NASA.gov. Initially, the vulnerability appeared to be a "dead bug" and unexploitable. However, by strategically using a backslash, the researcher was able to revive the bug and achieve the desired outcome. This discovery highlights how seemingly minor details can be crucial in security research. The content mentions a successful bug discovery but **does not state a specific payout amount**. |
| 2026-11-03 NEW 2026 | The Database Said No. The Disk Said Yes. intermediate | This article details a non-atomic file upload vulnerability. A server error (500) masked a successful PHP shell upload. The attack bypassed the error entirely using MIME-polyglotting, a technique that exploits how different parts of a file can be interpreted in various ways. This allowed an attacker to upload a malicious file, despite the database seemingly rejecting the upload. The database indicated failure, but the disk stored the shell, creating a dangerous bypass. |
| 2026-11-03 NEW 2026 | This Is How Phishing Links Slip Into Trusted Business Emails intermediate | This content explains how phishing links can infiltrate trusted business emails. It details a vulnerability in a purchase-inquiry workflow that allowed attacker-controlled links to be sent to recipients via legitimate business communication channels. The summary focuses on the mechanism of compromise rather than specific payout details. |
| 2026-11-03 NEW 2026 | Triager closed a detailed, verified report as "SPAM" (-10 rep penalty), and H1 Support refuses to mediate because of the resulting negative Signal. How is this allowed? news | A HackerOne user received a -10 reputation penalty and had a verified report closed as "SPAM" by a triager. HackerOne Support is refusing to mediate the dispute due to the resulting negative "Signal" score. The user is questioning how this process is allowed to happen and seeking community feedback on the platform's triage and dispute resolution mechanisms. No bug bounty payout amount is mentioned. |
| 2026-11-03 NEW 2026 | Cross-Site Scripting (XSS) via Malicious GIF Cyshield CTF 2026 intermediate XSS | This content describes a Cross-Site Scripting (XSS) vulnerability discovered during the CYSHIELD CTF 2026. The challenge involved exploiting a malicious GIF to achieve XSS. This follows a previous writeup that detailed a 2FA authentication flaw in the same CTF. |
| 2026-11-03 NEW 2026 | The Hidden IDOR Vulnerability in /me/ API Endpoints intermediate API Sec AuthZ IDOR | This guide explores Insecure Direct Object Reference (IDOR) vulnerabilities within `/me/` API endpoints. It focuses on practical bug bounty hunting techniques for discovering broken object-level authorization in modern APIs. The content provides actionable strategies for identifying these security flaws, crucial for protecting user data and improving API security. |
| 2026-11-02 NEW 2026 | Broken Access Control via Direct URL Navigation: Bypassing Premium Feature Restrictions intermediate AuthZ | This content details a security vulnerability where broken access control allowed users to bypass premium feature restrictions through direct URL navigation. The vulnerability means that even without a premium subscription, users could access restricted content simply by knowing or guessing the correct URL. This bypass indicates a flaw in how the system verifies user permissions before granting access to features intended for paying customers. |
| 2026-11-02 NEW 2026 | API Security Testing: A Complete Guide to Reconnaissance, Hidden Endpoints, Mass Assignment, and… beginner API Sec Recon | This guide covers API security testing fundamentals, including reconnaissance and identifying hidden endpoints. It also delves into common vulnerabilities like mass assignment. The content aims to equip users with the knowledge to effectively test and secure APIs. |
| 2026-11-02 NEW 2026 | The Mutation Everyone Tested, and the One Field Nobody Did: GraphQL Field-Level Authorization… intermediate API Sec AuthZ GraphQL | This article discusses a vulnerability in GraphQL's security model, specifically concerning field-level authorization bypass. While mutations were extensively tested, GraphQL's flexibility can lead to security weaknesses. The content highlights that field-level authorization is an area that was overlooked in testing, suggesting it's a potential entry point for attackers. No specific bug bounty payout amounts are mentioned in the provided excerpt. |
| 2026-11-02 NEW 2026 | GraphQL API Security: Reconnaissance, Common Vulnerabilities, Exploitation Techniques, and… beginner API Sec GraphQL Recon | This content, published by Shadow, delves into GraphQL API security. It covers essential reconnaissance techniques, common vulnerabilities found in GraphQL APIs, and effective exploitation methods. The focus is on understanding and mitigating security risks associated with GraphQL, enabling developers and security professionals to build more robust and secure applications. No specific bug bounty payout amounts are mentioned. |
| 2026-11-02 NEW 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 news 11 min read RCE | Library for understanding PHP2Shell, covering CVE-2026-109618 & CVE-2026-109619, their four confirmed attack chains, and organizational impact. It also highlights AI's influence on bug bounty trends, customer stories on proactive security, and the implications of ID verification changes for public bug bounty programs. Additional resources include a Microsoft Edge exploit chain using logic bugs, a Discord RCE via Twitch embed, and a Google RCE via Flask session pickle deserialization. → intigriti.com |
| 2026-11-02 NEW 2026 | Logistics company admin panel compromise news | A logistics company's admin panel was compromised. This panel is crucial for managing shipping for thousands of businesses and handling customer inquiries through a support system. The full scope and impact of the compromise are not detailed in the provided text, nor is any bug bounty payout amount mentioned. |
| 2026-11-02 NEW 2026 | Mozilla: Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML news XSS | Mozilla's Pontoon dashboards had a high-severity stored XSS vulnerability. The issue stemmed from the latest-activity tooltip improperly re-parsing a contributor's account address as HTML. This allowed malicious code to be injected and stored, potentially impacting users viewing the dashboards. No bounty amount was specified in the provided content. → hackerone.com |
| 2026-11-01 NEW 2026 | The Debugging File Nobody Removed Before Shipping: Secrets Exposed Through a Public Source Map intermediate Secrets | A critical security vulnerability was discovered when a developer accidentally shipped a source map file to production. This file, intended for debugging, exposed sensitive information like API keys and other secrets. The source map effectively de-obfuscated the compiled JavaScript code, making it readable and revealing these critical credentials. This highlights the importance of thoroughly checking production builds and removing debugging artifacts before deployment to prevent potential data breaches and unauthorized access. |
| 2026-11-01 NEW 2026 | Account Takeover via CSRF on the Email-Change Endpoint ($1,300) intermediate AuthN CSRF | A security researcher discovered a Cross-Site Request Forgery (CSRF) vulnerability in the email-change endpoint, leading to account takeover. This flaw allowed attackers to exploit user sessions to change a victim's email address without their knowledge or consent. The vulnerability was reported and the researcher was awarded a bounty of $1,300. |
| 2026-11-01 NEW 2026 | Cara Mengatasi Eror Jaringan Kali Linux & Burp Suite saat Pertama Kali Setup (Panduan… beginner Burp | This content is a practical troubleshooting guide for beginners encountering network errors when setting up Kali Linux and Burp Suite for web penetration testing and bug hunting. It aims to help users overcome initial setup challenges, likely focusing on common network configuration issues that arise during this process. The article provides solutions to ensure a smooth start in the field. |
| 2026-11-01 NEW 2026 | One Link to Unlink: CSRF in OpenAI Discord Verification Service intermediate 6 min read CSRF | Library for identifying and mitigating Cross-Site Request Forgery (CSRF) vulnerabilities, specifically detailing a finding in OpenAI's Discord verification service. The vulnerability, identified as a CSRF on the `/unlink` endpoint, allowed attackers to disconnect a user's OpenAI account from their Discord account via a crafted GET request without proper anti-CSRF tokens. This could disrupt community access and was classified as P3, medium severity, and has since been resolved. |
| 2026-11-01 NEW 2026 | CSRF in HackerOne Tray.io integration news CSRF GraphQL | Writeup of CSRF in HackerOne's Tray.io integration, demonstrating how an attacker can trick users into linking their third-party apps like Github and Jira to the attacker's HackerOne account due to a lack of CSRF protection. The vulnerability also allows unauthorized actions via the GraphQL API, such as accessing private Github repositories. This report details the exploit chain and discusses the bounty implications. |
| 2026-11-01 NEW 2026 | Wizard Takeover ATO (IDOR + CSRF) lab based on a real report intermediate 2 min read AuthN CSRF IDOR | Lab recreating a $1,500 bug on YesWeHack, combining IDOR and CSRF vulnerabilities in a pet memorial creation wizard. The lab exploits enumerable IDs, absent session binding, and a literal CSRF token acceptance to allow anonymous takeover of memorials, access to private data, and retrieval of a hidden flag. Vulnerabilities include CWE-639 (IDOR) and CWE-352 (CSRF), stemming from broken access control. |
| 2026-11-01 NEW 2026 | Intigriti Bug Bytes #241 (October 2026) news 9 min read | Library featuring techniques for exploiting logic bugs in Microsoft Edge, RCE via Discord Twitch embeds, Chrome full-chain bounties, Cloudflare XSS through SVG sanitizer bypass, and Google RCE from Flask session pickle deserialization. It also details PHP2Shell (CVE-2026-109618 & CVE-2026-109619), AI and bug bounty trends, proactive security for AI companies, and ID verification in bug bounty programs. Resources include guides on LLM prompt injection, vulnerability report writing, and a bug bounty starter kit, alongside tools like HexStrike AI and Claude-OSINT. |
| 2026-11-01 NEW 2026 | Cross-account JS execution in Basecamp Fizzy: five chained bugs to token theft advanced 7 min read AuthZ XSS | Analysis of five chained vulnerabilities in Basecamp's Fizzy application, demonstrating cross-account JavaScript execution leading to token theft. The exploit chain leverages an untrusted parameter in pagination URLs, parameterized HTML content types bypassing checks, orphaned blob authorization, Turbo's script execution with a leaked CSP nonce, and same-origin script execution to mint and steal API tokens. This research highlights the composition problem in web security, where individually safe decisions can create unintended attack paths. |
| 2026-11-01 NEW 2026 | The Hidden IDOR Vulnerability in /me/ API Endpoints intermediate AuthZ IDOR | This content discusses an Insecure Direct Object Reference (IDOR) vulnerability found in the `/me/` API endpoints. An IDOR flaw allows attackers to access or modify data they are not authorized to by manipulating object identifiers within requests. The specific details of the vulnerability and its potential impact are likely explored in the full article, which is currently only represented by its title. No bug bounty payout amount is mentioned. |
| 2026-11-01 NEW 2026 | IDOR, The Beginner’s Goldmine: The Bug Bounty Field Manual beginner 7 min read AuthZ IDOR | Manual for Insecure Direct Object Reference (IDOR) hunting in bug bounties. It details IDOR's prevalence, common patterns like sequential IDs and GraphQL node substitution, and provides a step-by-step hunting methodology using tools like Burp Suite. The manual emphasizes the core principle of authorization checks and outlines how to write effective IDOR reports. |
| 2026-10-31 NEW 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 news 11 min read RCE XSS | Library detailing CVE-2026-109618 and CVE-2026-109619, PHP2Shell vulnerabilities, alongside an analysis of AI's impact on bug bounty programs. It also covers proactive security strategies for AI companies, changes to ID verification in bug bounty programs, and the results of the Intigriti 1026 CTF. Additionally, it highlights exploit chains for Microsoft Edge and Discord, a Chrome full-chain bounty, XSS in Cloudflare, and Google RCE via Flask session pickle deserialization. Resources include HexStrike AI and Claude-OSINT for automated reconnaissance. → intigriti.com |
| 2026-10-31 NEW 2026 | Github Authentication Bypass on Major CRM intermediate AuthN | A security researcher discovered a critical authentication bypass vulnerability on a major CRM platform accessible via GitHub. This vulnerability could allow unauthorized access to sensitive customer data. The researcher responsibly disclosed the finding, and the CRM provider is reportedly addressing the issue. No bug bounty payout amount was explicitly stated in the provided content. |
| 2026-10-31 NEW 2026 | CWE-540 in the Wild: Hardcoded Credentials in a Production Analytics Script intermediate Secrets | A production analytics script was found to contain hardcoded credentials, a vulnerability categorized as CWE-540. This oversight, often stemming from a "we'll clean that up later" mentality, exposes sensitive information. The article highlights the real-world danger of such practices in production systems. No specific bug bounty payout amount is mentioned in the provided content. |
| 2026-10-31 NEW 2026 | Advanced Mobile Application Penetration Testing: Complete Lab Setup and Tools Guide advanced Mobile | This guide focuses on setting up a comprehensive lab environment for advanced mobile application penetration testing. It covers essential tools and configurations needed to conduct in-depth security assessments of mobile apps. The content is designed for professionals looking to master techniques for identifying vulnerabilities in banking, e-commerce, and other critical mobile services. No specific bug bounty payout amounts are mentioned in the provided text. |
| 2026-10-31 NEW 2026 | Pentesting/Bug Bounty d’une Application Mobile : Analyse dynamique. intermediate Burp Mobile | This content focuses on the dynamic analysis phase of mobile application pentesting and bug bounty hunting. It explores techniques and methodologies used to identify vulnerabilities in mobile apps by observing their behavior and interactions during runtime. The goal is to uncover security flaws that might not be apparent through static analysis alone. |
| 2026-10-31 NEW 2026 | A Sub-User Could Delete a Company in Munshi intermediate AuthZ | A security vulnerability was discovered in Munshi that allowed a sub-user to delete a company. This could have significant implications for businesses using the platform. The issue was identified and is likely being addressed to prevent unauthorized data loss and maintain system integrity. |
| 2026-10-31 NEW 2026 | Spring4Shell Step by Step: How CVE 2022 22965 Turns Data Binding Into Remote Code Execution in a… intermediate RCE | This content details the "Spring4Shell" vulnerability (CVE 2022 22965), explaining how it exploits data binding mechanisms within the Spring Framework to achieve remote code execution. The vulnerability arises from specific configurations and the use of `web.xml` or the absence of specific Spring configurations. Attackers can leverage this to overwrite arbitrary files on a server. The summary does not mention any specific bug bounty payout amounts. |
| 2026-10-31 NEW 2026 | From Shodan to an Unpaid Delivery: How a Chain of Weaknesses Led to Real-World Impact intermediate | This article details a security researcher's journey from discovering a weak credential on Shodan to uncovering a chain of vulnerabilities with real-world consequences. The researcher leveraged Shodan to find a vulnerable device, which then led to access to a system controlling delivery logistics. This access allowed the researcher to manipulate delivery information, resulting in an unpaid delivery. The narrative highlights how seemingly minor initial findings can escalate into significant impacts when multiple weaknesses are chained together. No specific bug bounty payout amount is mentioned in the provided text. |
| 2026-10-31 NEW 2026 | Giving an AI Agent a File Reader Without a Fence: Arbitrary File Read in an AWS Open-Source Tool intermediate AI | An AWS open-source tool, designed to provide AI agents with file reading capabilities, has a critical vulnerability. This flaw allows an AI agent to perform arbitrary file reads on any path accessible by the tool's execution environment. Effectively, by giving the AI agent a file reader without proper security restrictions ("without a fence"), the tool exposes sensitive data to unauthorized access. This could lead to significant security breaches if the AI agent is compromised or malicious. |
| 2026-10-31 NEW 2026 | ProxyShell Step by Step: How Three Exchange Flaws Chain Into Remote Code Execution in a Lab intermediate RCE | This article details the step-by-step process of achieving Remote Code Execution (RCE) on Microsoft Exchange Server by chaining three vulnerabilities. The exploit, dubbed ProxyShell, leverages flaws in the Exchange PowerShell backend to bypass authentication and execute arbitrary code. The researchers successfully demonstrated this attack in a lab environment, highlighting the severity of these vulnerabilities when combined. The content focuses on the technical exploitation path and the conditions required to achieve RCE. |
| 2026-10-31 NEW 2026 | From Out of Scope XSS to Account Takeover: The Iframe Sandwich (OWASP talk) intermediate AuthN Talks XSS | This OWASP AppSec Days Portugal 2026 talk by Dinis Costa, "From Out-of-Scope XSS to Account Takeover: The Iframe Sandwich," explores a security vulnerability. The presentation likely details how an initially out-of-scope Cross-Site Scripting (XSS) flaw, when combined with an "iframe sandwich" technique, can be escalated to achieve a full account takeover. The content is presented as a video by the OWASP Foundation on YouTube. Specific payout amounts are not mentioned. |
| 2026-10-31 NEW 2026 | IDOR Hunting Techniques Every Bug Bounty Hunter Should Know | by Samadhan Shimple intermediate AuthZ IDOR | This article by Samadhan Shimple outlines essential IDOR (Insecure Direct Object Reference) hunting techniques for bug bounty hunters. It covers common methods and strategies to discover IDOR vulnerabilities, which occur when an application allows users to access objects they are not authorized to, often by manipulating parameters like IDs in URLs. The piece aims to equip hunters with the knowledge to effectively identify and report these common security flaws. |
| 2026-10-31 NEW 2026 | How a Sneaker Order Led Me to an IDOR Vulnerability (and $50) intermediate AuthZ IDOR | A security researcher discovered an Insecure Direct Object Reference (IDOR) vulnerability in an online store, stemming from a simple sneaker purchase. This broken access control flaw allowed unauthorized access. The researcher reported the vulnerability and was rewarded with a $50 bounty for their findings. |
| 2026-10-25 2026 | Show HN: Steal My Bitcoin intermediate AuthN AuthZ | "Steal My Bitcoin" is a project, presented on Show HN, that challenges users to find vulnerabilities in its system to steal a designated amount of Bitcoin. The purpose of this initiative is to publicly test and improve the security of the Bitcoin protocol or related systems through ethical hacking. The title directly invites individuals to attempt to exploit weaknesses for a potential reward, highlighting a bug bounty-style approach to security testing. |
| Browse all 432 Bug Bounty resources → | ||
Frequently Asked Questions
- How do I get started in bug bounty?
- Start by learning common vulnerability classes (XSS, IDOR, SSRF) through platforms like PortSwigger Web Security Academy and HackTheBox. Create accounts on HackerOne and Bugcrowd, begin with programs that have wide scopes and are beginner-friendly, and focus on thorough reconnaissance before testing. Reading disclosed reports is one of the fastest ways to learn what works.
- How much can you earn from bug bounties?
- Earnings vary widely. Low-severity bugs may pay $100-$500, medium $500-$5,000, high $5,000-$20,000, and critical findings $20,000-$100,000+. Top researchers earn six figures annually. Consistency and skill matter more than volume — one well-researched critical finding outweighs dozens of low-severity reports.
- What makes a good bug bounty report?
- A good report includes a clear title, step-by-step reproduction instructions, the security impact explained in business terms, proof of concept (screenshots, HTTP requests, or video), affected endpoints, and suggested remediation. Reports should be concise, professional, and demonstrate that the vulnerability was not pushed beyond what was necessary to prove impact.
Weekly AppSec Digest
Get new resources delivered every Monday.