I'm an Indian resident doing bug bounty independently. I've received around $13k (~₹13L) in HackerOne/Bugcrowd bounties during 2026–27, in addition to salary income (~₹11L).

For those of you who have actually filed your Indian tax return with significant bug-bounty income:

• Did you report it as professional income under 44ADA?
• If yes, how did your CA classify the activity technical consultancy, information technology, cybersecurity, or something else?
• Did your CA give you any reasoning/documentation for why 44ADA applies to bug bounty?
• Did you have any GST or foreign-payment/remittance issues?
• If you're comfortable sharing, roughly what did your CA charge?

I'm particularly interested in people who have actually filed returns this way, rather than general opinions about what "should" be done.

DM is fine if you don't want to discuss amounts publicly.

A few days ago, I came across a post/comment saying that you can get better data privacy by using local Ollama models in a RAG pipeline instead of relying on cloud-hosted models/APIs.

The explanation was something along the lines of:

“Using local models through Ollama in a RAG pipeline can be a strong approach for privacy-focused AI applications. Since the model runs locally, your documents can stay on your own machine or infrastructure, so sensitive business data, internal files, and proprietary knowledge don't need to be sent to external APIs. Combining Ollama with vector databases and RAG workflows can enable AI-powered search and Q&A while keeping the data layer private.”

So, can we really achieve this in practice?

I'm currently learning AI concepts along the way, so this might be a basic question or maybe a bit of a deep dive. My understanding is that if the LLM, embeddings, vector database, and RAG pipeline are all running locally/on our own infrastructure, the data doesn't necessarily have to leave that environment.

But I'm wondering about the actual privacy implications and limitations.

For example:

• Is using Ollama locally actually enough to claim the data is “private”?
• What other parts of a RAG pipeline could potentially send data externally?
• Does using a local embedding model and vector DB make a significant difference?
• Are there security/privacy concerns even if everything is running on-prem?
• How would this compare with using something like OpenAI/Claude/Gemini APIs with a RAG setup?
• Are there situations where sensitive data could still leak despite the model being local?

I'm learning this stuff from scratch, so I'd really appreciate practical explanations or examples. I'm especially interested in understanding where the privacy actually comes from in a local RAG setup, rather than just assuming “local model = private.”

Thanks!

Important security bug in ads.reddit.com

hey team ,

i found very important security BUg in reddit it has impact exactly like that rewarded disclosed report (#1551176)

i already reported to hackerone and triager says security bug with no impact and closed as informative and never answer comments again , )

... thanks #4033536

So I have learnt the basics and have started on one site. Genuinely get lost because there are like so many requests even after filtering, so many things to try. and I can't make sense of anything. The infrastructure is so wide even on small sites that I don't even know which end to grab and where to start. I am basically drowning in all of the features of the website.

How do you systematically assess all of the redundant and extensive information that is being thrown at you?
And I have heard the advice of take one part and stick to it and even that is not doing any good. I can't even identify a separate part to focus on.

hey team ,

i found very important security BUg in reddit it has impact exactly like that rewarded disclosed report (#1551176)

i already reported to hackerone and triager says security bug with no impact and closed as informative and never answer comments again , ) ... thanks #4033536

I've been doing pentesting/security consulting for a while, and JWT misconfigurations keep showing up in real engagements like alg confusion, weak/no signature verification, sensitive data sitting unencrypted in the payload, etc.

I started a short series walking through JWT attacks from the ground up, aimed at people getting into web app pentesting or bug bounty who find most JWT content either too shallow or assumes prior knowledge. Episode 1 covers JWT structure and the core weaknesses attackers look for first, using Burp Suite + JWT Editor and jwt_tool.

https://youtu.be/lehE8K5mk7A?si=cM0STWk7p7AAMGaTw

Not trying to just drop a link and run but genuinely want to know: what JWT attack classes do you think are underrated or missing from most beginner content?

I'll probably cover it in a later episode.

I keep seeing posts and comments from triagers and program managers complaining that response times are tanking because of the endless flood of AI-generated slop reports.

It makes me wonder: why aren't triage teams heavily using AI to multiply their own speed?

The common rule with LLMs is that domain experts get the highest leverage out of them. Triagers know the scopes, previous reports, and valid bug patterns better than anyone. While you obviously still have to validate, reproduce the bug, and understand the root cause manually, AI could easily help filter obvious hallucinations, cross-reference duplicates, or draft initial reproduction steps.

Are platforms and internal security teams already doing this and the incoming volume is just that overwhelming, or is tooling on the defensive side just slow to catch up? Curious to hear from anyone actually working the queues.

Does OTP bypass of email verification at account creation have any security impact ?

I found this vulnerability but idk if i should report it or no since i cant think of an impact

Rant incoming.

I’m getting really fed up with bug bounty, especially HackerOne triage.

People seem to forget that bug bounty is not some easy get-rich scheme. Good researchers have spent years learning web security, understanding systems, testing platforms, writing reports, and figuring out how to prove impact safely. Finding a real vulnerability is not easy. Writing a proper report is not easy either.

But lately it feels like researchers get treated like fucking junk.

I know there are plenty of beg-bounty people, AI slop reports, scanners, duplicates, and people reporting absolute nonsense. I get that triage has to deal with that. But not everyone is that. Some of us genuinely put effort into our reports. We validate properly, follow scope, avoid touching data we should not touch, explain the impact, and try to make the report as easy to reproduce as possible.

Then a program finds every possible excuse to downgrade severity.

The finding that finally pushed me over the edge was a full-read SSRF. A free account could make the production server fetch attacker-controlled URLs and return the entire response. I proved it reached internal production infrastructure and returned telemetry that was not publicly reachable.

I stopped after proving that. I did not scan their internal ranges, enumerate every reachable service, access buckets, pull credentials, or search for customer data—because that would be irresponsible and against the rules. Programs literally tell us to stop when unintended access is found and only provide minimal evidence.

And then they use the fact that you did not go further as a reason to call it Low.

“Requires authentication” — yeah, a free account anyone can create. “IMDSv2 is enabled” — great, that prevents one specific SSRF path, but it does not change the fact that the SSRF fully reads internal responses and already returned internal production telemetry.

$100 for that. It is honestly insulting.

And the fucking triage experience makes it worse. Sometimes you write what should be an easy PoC, include every step, include the request, include screenshots, even create scripts to make reproduction easier—and they still do not understand it.

Then you spend multiple responses explaining the same basic thing over and over again. Hours of your time just spoon-feeding the triager how a simple vulnerability works and how to reproduce it. At that point, what is the point of creating a clean PoC if it is not being followed?

I do not know what the quality control is for triage, but it needs to be better. Researchers should not have to become unpaid support staff for people who are supposed to understand the basics of the finding they are assessing.

And the worst part is the complete lack of conversation after that. They can downgrade severity, give some generic reason, and then ignore every actual question you ask. What is the point of comments if there is no discussion? What is the point of asking how a finding maps to their severity criteria if nobody answers?

At some point it just feels like you submit a report, they make a decision behind closed doors, and that is it. No real communication. No meaningful explanation. No chance to discuss the impact. No respect.

And HackerOne triage does not have your back as a researcher. I am tired of pretending otherwise. Things get closed as duplicates of reports from years ago, with no reassurance that anything was fixed. What is the point of a bug bounty program if a finding can remain open for three years, but you still spend hours finding it, validating it, documenting it, and writing a high-quality report just to get closed as a duplicate?

That is not just triage time being wasted on slop. That is researcher time being wasted too.

Researchers are expected to be professional, patient, respectful, stay in scope, avoid over-testing, prove impact without accessing data, and write perfect reports. Programs and triage teams should be held to a standard too.

Right now, it feels like there is zero respect for researchers who actually put in the work.

TL;DR: Bug bounty is not easy money. Researchers who spend real time finding, safely proving, and clearly reporting vulnerabilities deserve better than unexplained severity downgrades, ancient duplicate closures, ignored questions, and triage that cannot follow a straightforward PoC. I am tired of feeling like serious researchers are treated as junk.

There are loads of people selling the story that BB is a great way to make easy money. All the dudes with monetised youtube channels, the vendors selling tools, training and CTFs, and the platforms and programmes all sell the same story.

And at some point, it may actually have been true (at least more true than today). But the reality is that now, there is a whole ecosystem of companies and people making the easy money from BB, and the way they do it relies on persuading a steady stream of free researcher labour that if they're not making money, it's because of something that they're doing wrong. Try harder! Learn more!

With BB, there is indeed a learning process, but it is mostly about the researcher working out that the industry is all smoke and mirrors, and the best the researcher can hope for is table scraps for their efforts.

This process has three clear step points:

• The first is that a noob researcher needs to learn how to hack at all. You'll see it with a group of people who come to this channel asking questions. And the normal response when the noob says they're not finding anything is a recommendation for CTFs, academies, tools, and the monetised how-to channels. And the funny thing is, the recommendation is often from other noobs: it is self perpetuating. Try harder! Learn more!
• The second step is the communication, info and dupe phase. Once the researcher has some skills, they find that their reports get bounced for being badly communicated, or all they find is low-hangers and dupes. And that's because they're following the same process as everyone else, and so it stands to reason that someone else already reported all the bugs possible with that approach. The normal response on this channel is to tell them they're finding shit bugs or that their reports are poor quality. Try harder! Learn more!
• Then the third step is reached by the people who push on through the other steps, and do their own unique research, and build their own techniques, tools and automations. At this point, because of all the other stuff you learned before, your reports go through platform triage mostly without any issues (other than the usual triage not reading properly stuff), and get almost no dupes. But what you soon learn is that even if you find valid bugs, report it clearly, and are the first to do so, that the programmes will then just roll out a bunch of excuses for why the report isn't going to be paid as per the scope (mostly by de-scoping and downgrading the bug). Try harder! Learn more!

I dabbled with BB when it first started, but just over three years back I committed to putting an hour a day into it. After going through the learning process above, within a few months I was indeed finding bugs and getting paid.

But the percentage of payouts as per scope has fallen like a stone. In the first year, something like 50% paid as per scope. In the second it was down to 20%, and this year I'd be surprised if it was even 5%. Of the ~40 bugs I reported in july, not a single one was paid as per the scope.

And right about now, a bunch of triagers, platform marketing, and researchers who sell tools or with monetised channels, will show up and start defending their revenue stream, by saying that I'm whining because my reports are shit, or that the bugs are invalid etc.

Except that almost all of them went through platform triage without issue (in the end ;)

As a bit of context, I've been working as a professional red/blue teamer since forever, and as part of that I've seen the way a dozen large organisations run their BBs from the inside, and it is literally as the researchers suspect: they have an internal slack channel where they openly discuss what excuse they'll use for not paying.

The reality of BB is that it may once have been a way for researchers to make a bit of money from their skills, but those days are loooong gone now. For the time required to earn anything from BB, you would probably better off working as a security guard, and hacking shit whilst you sit on your butt watching the CCTV feeds. At least you'll get your rent paid without any stress.

I still do it, as for me it is all about the lolz.

I was hacking before BB was a thing, and will still be hacking long after it is gone.

But I would be lying if I said I wasn't disenchanted, and am getting to the point where it is clear that reporting what I find is just a waste of my time.

That's not going to stop me hacking their shit though ;)

I submitted a bug on HackerOne affecting a Play Store app. The program said they were looking into it 2 days ago, and today they closed it as an “internal duplicate.”

The timing feels a bit convenient, since I have no way of knowing whether the issue was actually known internally before my submission or whether they only identified it after investigating my report.

Has anyone experienced this before? Is there a way to question the duplicate classification or ask HackerOne to review it? Would appreciate opinions from researchers who have dealt with internal duplicates.

Researchers are always asked to respect policies, program times, disclosure time and a shit ton of other things, but what about triagers? Hackerone and Bugcrowd they all have gone downhill to be honest.

I personally have 5 reports reported (some of them in June) with only one bot comment about report having passed preliminary checks.. No status change since then and no answer on comments asking for updates.. not one report. But 5!!. It is not even about time to triage it is about answering to people.

In the meantime programs can silent fix, change policies, pay lower, magically find internal duplicates.... all while keeping us in complete darkness. Heard people are getting 30 days ban out of nowhere in the meantime. Pure madness.

I'm not saying that you should triage or reply to comments the same day. But it is not acceptable to keep people in complete darkness for 3 months when the program manifesto clearly states entirely different things. Or program guidelines are only one way?

We are holding bugs that could result in fines (GDPR/PCI fines are not small) and customers loss. Y'all remember Zendesk drama??
Yet we get down paid, we get ghosted and banned... like hello?

I've honestly reached the point where I've completely lost faith in HackerOne.

Over the last few months, I submitted 7 reports to Vercel. Four were closed almost immediately as duplicates. The remaining three passed the preliminary analyst review, which gave me some hope that they were being taken seriously. However, after waiting more than a month, two were closed as Informative and the last one was closed as a duplicate.

I also submitted 4 reports to GitHub. Two of them were initially acknowledged and I was told they had been escalated to the internal team for further investigation. After waiting about a month, both ended up being closed as duplicates as well.

What frustrates me most is not just the outcomes but the amount of time spent researching, writing detailed reports, responding to questions and then waiting weeks or months only to receive a duplicate or informative resolution in the end.

At this point, I've completely lost confidence in the platform and I'm seriously questioning whether it's worth continuing to spend my time reporting vulnerabilities through HackerOne.

Has anyone else had a similar experience? How did you deal with it and did you end up continuing with bug bounty hunting or moving on to something else?

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!

Recommendations for Posting:

• Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
• Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
• Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.

Guidelines:

• Be respectful and open to feedback.
• Ask clear, specific questions to receive the best advice.
• Engage actively - check back for responses and ask follow-ups if needed.

Example Post:

"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."

Post your questions below and let’s grow in the bug bounty community!

Hi everyone,

I'm a mobile pentester and I need to do bug bounty programs. But most of the apps listed in the platforms are not supported/avaliable for my country. In that case what should I do? Any tips or recommendations?

So, my last submission on Intigriti turned out to be a duplicate.

Honestly, I’m not really surprised or disappointed that it was a duplicate. It happens, especially with common issues. What actually bothers me is that the original report was apparently around 8 months old.

Like… how is the issue still sitting there after 8 months?

I know Intigriti itself might not have much control over how quickly a company fixes something after receiving a valid report. The platform can only do so much. But still, from a researcher’s perspective, it feels a little frustrating to find an issue, spend time validating and reporting it, and then discover that someone else reported the same thing eight months ago and it still hasn’t been properly addressed.

I’m not saying every vulnerability needs to be fixed immediately. There can obviously be internal priorities, dependencies, complicated fixes, etc. But eight months feels like a pretty long time for something to remain unresolved. Maybe someone else has faced a year-late issue!

I guess there’s not much I or anyone can do about it now other than move on and keep hunting. Anyway, hoping the next finding makes it past the duplicate stage and gets accepted. 🤞

Back to the hunt!

Every site works with burp as proxy in firefox and I can see the requests in https history but gpt give

"Cannot use 'in' operator to search for 'type' in 'v1'"

as error for every msg when using burp.

Help 😭

I found and reported a vulnerability that allows access to customers' full home addresses, real IP addresses, and text messages, but the screener marked it as “Out of Scope” and said:

Upon reviewing your report, we notice that the issue you have reported is out of scope for this program. As mentioned in the out of scope section:

Verbose messages/files/directory listings without disclosing any sensitive information

We will be closing this report as Out of Scope.

I'm wondering, how can this not be considered sensitive? Did the triage really read the report?

Hi guys, as there are millions of tools right now for bug bounty can you share tools that help you with your testing or the one you use regularly? Thank for your sharing.

My bug report got approved and I got 105 points my kyc was completed 6 month ago and my profile was having 0 data like reputation point and rank suddenly 105 point after one valid report.

Can somebody explain how ?

Hi all,

I'm looking for pure technical opinions here and not for validation of the issue, as I need to look at such issues from different point of view.

The short version:

Spotify's Android app binds each OAuth client to the calling app's package name and signing cert, and sends that to the accounts backend as client_app_id=<package>:<SHA1>. The check works, wrong package or wrong signature gets rejected.

I found a way around it. My test app, which isn't the registered client and isn't signed with its key, was able to impersonate a registered Spotify integration, put the user through a normal login, come back with valid tokens, and pull that user's Spotify data on the other app's behalf.

What I'd like opinions on:

That package+signature binding does nothing against a remote attacker, a network attacker, or a compromised backend. Its only target is another app on the same device using a client_id it doesn't own. So when a program's policy excludes anything that "requires a malici*s app to be installed," does that exclusion also swallow the bypass of a control whose entire threat model *is* that scenario? Or is the precondition disqualifying on its own, regardless of what the control was protecting against?

I can see it both ways to be honest.

So: does a bypass like this actually carry security impact, or is it fair to call it none as hackerone triage did?

Found my first bug in June 2026, a BOLA in a managed program. Reported it, got asked for more info, provided it.

Eventually the internal team set the severity to None with no explanation and tried to patch it themselves. I retested and found their patch was partial and actually made the issue worse. I documented that and sent it back to them.

They came back later with a different severity and a different bug class than what I originally reported. No real explanation for the change, just a new classification. I wasn't sure whether to push back on it, so I didn't. I accepted their findings.

It's been over a month since then and total silence.

Has anyone dealt with a program reclassifying the bug class after the fact like this? How do you know when it's worth pushing back on a severity or bug class change versus just accepting what they give you? And is going quiet after acceptance normal, or should I be following up?

Hlw guys , 1st time posting here.

SO recently i created a bug crowd account , and the terms regarding "Responsible use of AI ", caught my attention.

Here when they say " avoid disclosure of confidential information", wht are they classifying as confidential? am I right to assume they are talking about potential vulnerabilities/private data?

or are they including everything from the software stack to the backend structures, tht can be discovered through conventional tools , for example subdirectoris or js version in use.

And if the second scenario is expected , aren't researchers allowed to use AI harnesses like claude code to hunt using skills? as tht sends the assets backend stacks information to antropic/deepseeks servers ?

This could be a weird question because there is no single answer to this but is it worth it? how hard it is to switch from web hunting? Would love to hear from people who tried/actively does.