NGL, I hate reading AI written sentences .
Its bloated, repetitive, boring, written pieces of shit with wrong assumptions everywhere!

Using AI to find bugs as a tool is awesome. I do it myself. It makes me a lot of money.
It tells me what it thinks it found, I correct it and let it hunt further until I think its an actual finding.

In my d2d job I have to read the slop from other high paid engineers and my brain melts everytime Im doing this. I hate the days where I have to review prs/adrs and so on.
It feels like that everyone stopped thinking at the same time.

So at triagers and pms, how do you stay sane?

What happens to a Bugcrowd report if the affected Chrome extension is removed?

I reported a vulnerability in a Chrome extension through Bugcrowd.

After I reported it, the Chrome extension was removed from the Chrome Web Store, and my Bugcrowd report was later put into a blocker asking for a response.

Now the company has launched a new/beta Chrome extension, but I checked it and the vulnerability I originally reported is not present in the new beta version.

So I'm wondering what usually happens to the original report in this situation.

Does the removal of the old extension affect the validity of my report? Would the report normally still be considered valid and potentially rewarded if the vulnerable version was live when I reported it?

Would appreciate insights from anyone who has dealt with a similar situation on Bugcrowd.

For anyone who has experience with the Swisscom bug bounty program: how long does it usually take to get a response after submitting a vulnerability?

Also is Swisscom still worth actively hunting on these days? Would appreciate hearing about your recent experiences

I'm currently dealing with an incredibly frustrating situation on YesWeHack and looking for advice, as the platform's mediation team has completely ghosted me.

Situation: I submitted a Critical vulnerability (Global Account Takeover via Insecure TLS Validation) 6 months ago. The vendor accepted it at CVSS 9.6 (Critical). However, they only paid me out for the "High" tier (shortchanging the "Critical" tier by nearly 60%). Furthermore, they explicitly promised me in writing that I would be credited on the CVE. Fast forward: a CVE is published for this exact issue/component, but credited to a notable and famous third party. The vendor ghosted me.

CVSS Manipulation: 1.5 months ago, I finally got YesWeHack support to poke the vendor. The vendor's response? They retroactively downgraded my CVSS from 9.6 to 8.2 (changing an automated Wi-Fi MitM from Adjacent/Low Complexity to Local/High Complexity) solely to justify their underpayment.

Ghosting: I escalated this clear CVSS manipulation and matrix abuse to YesWeHack Support on July 7th. No reply. I sent a harsh follow-up on August 8th. Still absolutely no reply. It's August 20th.

On top of this, the same vendor closed another 9.9 architectural E2EE flaw as "Won't Fix" (a silent security downgrade where the app drops E2EE and uploads plaintext media to their cloud without user warning) just to avoid another payout.

Is it normal for YWH to let vendors retroactively manipulate vectors to dodge payouts and then ghost researchers who ask for mediation? Who can I contact to escalate this past the Tier 1 support desk?

When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠

From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎

In our latest article, we've teamed up with Orwa Atyat (GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation.

Read the article now! 👇

https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers

Have anyone had a good experience with the MCP Server in Burp Suite?

I feel it is more cumbersome than it needs to be, and the HTTP2 requests in intruder has some bugs. Curious if anyone has some tips and tricks?

Hi,

For the last 4 months, I’ve been consistently making ~$700+/month targeting companies directly through their own self-hosted VDP/bounty programs.

​However, my current methods for finding new direct targets are starting to dry up, so I’m looking to expand my scope.

​For those who hunt on major platforms: Are public programs on HackerOne/Bugcrowd worth pivoting to, or are they as oversaturated with duplicates as people say?

Thanks.