malek
@MalekMohamed0
Followers
567
Following
103
Statuses
188
Here's why avoiding VDPs makes sense: Same company, two public profiles: VDP & BBP. 🔗 BBP: 🔗 VDP: Reputation points don’t pay bills. Many programs have BBP, but they’re private.
1
0
2
@OriginalSicksec I don’t quite understand what you mean, but after reporting it to the team, they should verify if it works in production. If it does, then it should be considered a production-level issue.
0
0
0
Does Islam forbid reporting vulnerabilities found through automation to companies in industries like poker, adult content, or alcohol sales? I rarely find these, but am I just losing money without any good deeds? Any thoughts with evidence? #bugbounty
0
0
0
RT @Jayesh25_: 🚀 Unspoken Bug Bounty Rules – From many years of failures & experience! 🕵️♂️ Got a similar bug across multiple assets but…
0
56
0
@zhero___ @gui_scombatti @Hacker0x01 Congrarts, Allahumma barik! Make sure your DMs are open for non-verified users so people can reach out to you.
0
0
1
Marked as a duplicate to 'internally tracked.' 100% sure this isn’t a duplicate, but there’s nothing I can do. Takeaway: If the company doesn’t want to pay, they won’t. Move on. Bug hunters need lawyers.
1
0
10
@zhero___ Good detailed research, I think I have a few targets, Can't DM you, Can you send a message?
0
0
1
Excellent research! I read it years ago and have always wondered if it’s ever been used in a real-world exploit.
Content Type Research is a Github repository by @black2fan dedicated to documenting interesting content type processing that can lead to CSRF & XSS vulnerabilities in browsers and popular technologies! 🤑 It's worth checking out! 👇
0
0
0
@XavOppa @yeswehack If that's true, share his name and the conversation between you two so others can avoid falling into the same trap. Collaboration is built on trust. May Allah bless you with something better.
0
0
0
I couldn’t stop laughing at this; he used the only real weapon bug hunters have!
16
12
174
I know HackerOne’s triaging has had a lot of mistakes lately, and I've experienced it myself, but this? Seriously! And of course, the mediation has been going on for 3 months with no response, as usual.
5
4
61
1
0
1
@albinowax Would it be possible to make all submitted articles public, not just the nomination list? This way, others can help catch anything missed, and it could also be a great place for gathering public research, even if some articles aren't nomination-worthy.
1
0
0
@c3l3si4n Why not make all the data freely accessible? People could benefit from using regex directly, and implementing it online can be a bit challenging.
0
0
0
RT @omooretweets: New productivity hack - I asked Gemini Realtime to watch my screen, and yell at me when I waste time. It gets increasin…
0
232
0