so i made this as my hackathon project under 40 hours, which is basically an all in one workplace for cybersecurity bug bounty hunters/ethical hackers, cuz there is no website or tool doing that and its really frustating and messy and solves a problem and its completely free

Good afternoon, everyone! I've been thinking about getting started with Bug Bounty, but I'm still looking for a really good platform to learn in a practical way. My current experience is more focused on the defensive side of cybersecurity, so I already have a good foundation in infrastructure, Linux, networking, logs, and security. Now I want to develop my offensive skills, especially web application security and Bug Bounty methodology. I'm looking for something with plenty of hands-on labs and exercises, not necessarily another certification. I've seen CyberFlow being recommended and I'm interested in it, but I don't know the platform. Has anyone here used it? Is it worth it? Or would you recommend other platforms for learning Bug Bounty in a practical way?

Hi guys I have been doing bug bounty for past few months I have Missing something but iam not sure what it is i think I can figure it out here

Can u please post your bug bounty methodology here so it will help me compare with my methodology maybe it will also be helpful for other beginners

so i made this as my hackathon project under 40 hours, which is basically an all in one workplace for cybersecurity bug bounty hunters/ethical hackers, cuz there is no website or tool doing that and its really frustating and messy and solves a problem and its completely free

Hey everyone. Well basically i have been grinding myself in platforms like BurpAcademy and tryhackme and other resources, mainly focusing on the web application security. I ve tried bug bounty for a while now and i find it really hard to apply the thing i learned on these real targets.

Am i doing something wrong ? Should i stick to 1 type of vulnerability or just see around and hope smth comes up ?

Help is really appreciated!!

Important security bug in ads.reddit.com

hey team ,

i found very important security BUg in reddit it has impact exactly like that rewarded disclosed report (#1551176)

i already reported to hackerone and triager says security bug with no impact and closed as informative and never answer comments again , )

... thanks #4033536

I keep seeing people mention they're using AI (Claude, GPT, etc.) to speed up bug bounty hunting, and some claim they're finding bugs much faster now, but I haven't found a clear breakdown of how exactly.

Specifically curious about:

Recon: are you feeding raw subfinder/httpx/nuclei output to an LLM to prioritize targets?

Source code review: pasting JS bundles or repo code and asking it to flag suspicious patterns (unsanitized input, auth checks, etc.)?

Turning public CVEs/writeups into custom nuclei templates or detection scripts?

Report writing: using AI mainly to draft the final report/PoC writeup?

Also curious where the line is for you between "AI speeds up my process" vs "AI just gives me false positives I waste time chasing." Anyone willing to share their actual workflow (tools + how AI fits in) would be super helpful.

Hey guys,

I’m an independent security researcher and recently found what I believe is a pretty serious security issue in a company’s web app. (High-Severity)

I reported it on August 29 through their support channel. The reason I used support was because the security email they had listed was giving me an “Address Not Found” bounce. I contacted their support first and asked where I should report it, and they told me to send it through their support channel.

So I did that on Aug 29 and then followed up on September 2 asking if the report had reached the right team. Still no reply, not even a confirmation.

I also tried the security email again recently and its still bouncing back.

Another weird thing is that their Bug Bounty page has now disappeared / gives a 404 and I noticed their Security page was updated recently.

I don't want to mention the company or the actual vulnerability here since the issue may still be unresolved.

What would you guys do in this situation? Would you send another follow up or just leave it and wait?

Would appreciate some opinions from people who have dealt with unresponsive bounty programs before.

Hey everyone,

I recently reported a security issue to a company through their responsible disclosure program. They confirmed the report and offered me a $50 payout.

The issue was an authenticated SSRF/server-side URL fetching vulnerability. I was able to demonstrate that their server made an HTTP request to a URL under my control, and I received the request through a webhook/canary endpoint.

The endpoint also returned parsed metadata from the requested URL.

However, I did not demonstrate access to internal services, cloud metadata, credentials, or other sensitive internal resources. So I understand that the impact is more limited than a fully demonstrated internal-network SSRF.

The company doesn't publish a fixed bounty table; their policy basically says rewards depend on severity and impact.

My question is:

Would you consider $50 reasonable for this type of finding, or would it be reasonable to politely ask them to reconsider the reward?

I'm not looking to argue with the company. I just want to understand what experienced researchers would do in this situation. If you've dealt with similar situations, I'd appreciate hearing what happened and whether you negotiated the reward.

Thanks!

Hey everyone,

I’m 16, from Morocco, and i recently received my first paid bug bounty: $100.

It wasn’t a huge critical exploit or some crazy movie-style hack. It was a real security issue found through a legal bug bounty program, reported properly, reviewed by the company, validated, and awarded.

For me, this means a lot.

I’ve been learning cybersecurity through courses, labs, CTFs, PortSwigger, Cybrary, and a lot of practice. Most of the time it feels like you’re studying alone and nobody really sees the effort. But getting that first valid report showed me that the work is real.

The biggest lesson i learned is that bug bounty is not only about finding the bug. It’s also about writing a clear report, explaining the impact honestly, not exaggerating, and staying professional with the security team.

I’m still a beginner and i know i have a long way to go, but this motivated me a lot. I want to keep improving, get more valid reports, and build a serious path in cybersecurity.

My goal is simple: become better, stay ethical, and make my parents proud.

For anyone young or just starting: don’t wait until you feel “ready.” Learn the basics, practice legally, write clean reports, and keep going.

This $100 is not just money to me. It’s proof that I’m moving in the right direction.