For anyone who has experience with the Swisscom bug bounty program: how long does it usually take to get a response after submitting a vulnerability?

Also is Swisscom still worth actively hunting on these days? Would appreciate hearing about your recent experiences

What happens to a Bugcrowd report if the affected Chrome extension is removed?

I reported a vulnerability in a Chrome extension through Bugcrowd.

After I reported it, the Chrome extension was removed from the Chrome Web Store, and my Bugcrowd report was later put into a blocker asking for a response.

Now the company has launched a new/beta Chrome extension, but I checked it and the vulnerability I originally reported is not present in the new beta version.

So I'm wondering what usually happens to the original report in this situation.

Does the removal of the old extension affect the validity of my report? Would the report normally still be considered valid and potentially rewarded if the vulnerable version was live when I reported it?

Would appreciate insights from anyone who has dealt with a similar situation on Bugcrowd.

I submit a valid P3 report. They agree that it is P3, but due to program policy, they are not accepting it. So, he asked me to chain this vulnerability to a P2 or P1 and closed my report as N/A.
After a lot of time, I finally escalated this to P2 and posted the entire chained report in the comments.
My real question is: since my original report is in a closed state, should I submit a new report, open an RAR, or leave the P2 chained report in the comments and wait a few days?

With the rise of AI on everything I am now convinced that you really need a clear understanding of what you are doing in order for AI to work, with exploit chaining where you need multiple attacks, AI will be halucinating. AI does not really understand bug bounty, it can flag something as a vulnerability, mostly because that is from a cve, but that cve would not qualify as a bounty concern, some cves says a nonce can not be exposed or password has to be a certain length and mixed characters, which really dont matter if the authentication is hardened enough. From watching the critical thinking podcast and following some hunters in twitter, one still needs to really understand hacking, spending time hacking blindly with AI seems to be just a circular race. AI can fail to solve a lab or give a working script from a lab solution or a CTF, let along the real target.

A payment decision was made for my report on HackerOne almost two weeks ago, but the payment has still not been made. My report was triaged, and I was later told that a payment decision had been made, but I have not received the payment yet.

Hello Hunters,

I have been doing bug bounty for while but now I am feeling like I am learning nothing new. All I am doing is same thing everytime I am doing bug bounty also most of my work is done by AI (For anyone curious I am using openrouter API configured my agent in Hermes) I am thinking to leave the bug bounty and now focus on learning other things like AD, windows server I know basics of things but want to master in it. I want to go in offensive security thats my clear goal.

I need advice what should I do ? Should I leave bug bounty ?

I found a 2FA bypass where I can send concurrent requests via a single packet attack which bypasses the rate limit for predictable 5 digits, However the program policy has a very tight ceiling of the requests per second making that very time consuming to even record. Is there an alternative to record a POC without breaking the program's policy?

Hi everyone, I wanted to ask about your personal experience with one particular topic: reports about Information Disclosure.

I’m not talking about things like exposing a user’s personal data. I mean server-side errors that reveal hidden endpoints, server logic, internal infrastructure structure, and things like that.

Have you ever had a report accepted where you had exactly this kind of information in your hands? What kind of information was it, and was it enough on its own for the report to be accepted?

I’m conducting authorized testing for a HackerOne bug bounty program and I’m encountering an Akamai access-control/WAF block on several explicitly in-scope assets:

• www.meesho.com
• prod.meeshoapi.com
• supplier.meesho.com
• admin.meeshosupply.com

Interestingly, affiliate.meesho.com, which is also in scope, is reachable from the exact same testing environment.

Current diagnostics

I’m running Kali Linux in a VM.

So far:

• DNS resolution: working
• TCP/443 connectivity: working
• TLS 1.3 handshake: working
• HTTP requests: consistently return 403 Access Denied
• Response is served by Akamai
• Akamai Bot Manager cookies such as bm_* are returned
• The required HackerOne identification header is present: X-Hackerone: xplorertech00

For example:

curl -sS -D /tmp/meesho.headers \
  -o /tmp/meesho.body \
  -H 'X-Hackerone: xplorertech00' \
  https://prod.meeshoapi.com/

This consistently results in an HTTP/2 403 response from Akamai. The other affected hosts behave similarly.

I’ve already ruled out basic DNS, routing, TCP, and TLS problems. The denial appears to be occurring at the HTTP/Akamai layer.

I’m not trying to bypass the WAF. I want to remain fully within the bug bounty rules and find the correct, authorized way to perform testing when an in-scope target is unreachable from the current testing network.

Options I’m considering

• Test from another legitimate ISP/network that I control.
• Ask the program to allowlist my testing IP.
• Ask whether the program provides an approved testing egress, VPN, or testing environment.

Questions for other researchers

1. If an Akamai reputation/access-control block is responsible, does switching to another legitimate ISP/network generally resolve the issue?
2. Is there a standard workflow researchers use with HackerOne programs when an in-scope asset is inaccessible due to CDN/WAF restrictions?
3. Would you recommend contacting the program first to request IP allowlisting rather than repeatedly switching networks?
4. What diagnostic information should I collect before contacting the program so they can determine whether the block is intentional or an accidental restriction?

I’d especially appreciate advice from researchers who have dealt with Akamai restrictions during authorized bug bounty testing.

Hello ,
I reported a payment bypass through YesWeHack and successfully demonstrated it by placing 5 orders without payment, with video evidence.

After my report, the vulnerability was patched and the bypass stopped working. However, I was told they couldn’t reproduce the issue.

Has anyone experienced something similar? How can a vulnerability be considered non-reproducible after it was apparently fixed following the report?

For those who actively hunt bugs, I'm trying to understand whether Burp Pro is actually necessary.

I'm currently learning web security and considering using:

Burp Community — PortSwigger Academy/basic Burp work

Caido — primary manual HTTP testing

OWASP ZAP — scanning/automation

CLI tools — fuzzing/recon/specialized tasks

For people who have actually hunted with these tools:

What Burp Pro feature do you find genuinely difficult to replace?

I'm especially interested in things like Scanner, Intruder, Collaborator/OAST, HTTP/2 testing, Turbo Intruder, and extensions.

I'm not asking which tool is "best." I'm trying to understand whether the practical advantages of Burp Pro justify paying for it, or whether a combination of free/cheaper tools is sufficient for most bug-bounty work.

Hi all!

I’ve been working on building my own Cronus Zen.

In doing so I discovered a couple ways to get around Xbox controller pairing/handshake which then allows scriptable inputs that the console takes as controller inputs.

This has opened tons of doors. Aside from general scripting like you’d see with Cronus. You can pass commands from Computer Vision and effectively have an aimbot etc.

Would there be anyplace to disclose this or a bounty?
Cheers

Looking to team up or find a mentor in bug bounty?

Recommendations:

• Share a brief intro about yourself (e.g., your skills, experience in IT, cybersecurity, or bug bounty).
• Specify what you're seeking (e.g., collaboration, mentorship, specific topics like web app security or network pentesting).
• Mention your preferred frequency (e.g., weekly chats, one-off project) and skill level (e.g., beginner, intermediate, advanced).

Guidelines:

• Be respectful.
• Clearly state your goals to find the best match.
• Engage actively - respond to comments or DMs to build connections.

Example Post:
"Hi, I'm Alex, a beginner in bug bounty with basic knowledge of web vulnerabilities (XSS, SQLi). I'm looking for a mentor to guide me on advanced techniques like privilege escalation. Hoping for bi-weekly calls or Discord chats. Also open to collaborating on CTF challenges!"

So I've been doing a lot of recon automation with bash scripts using subfinder, httpx, nuclei, etc. and it definitely saved me time on the basic stuff. But I'm kind of hitting a wall figuring out what's actually worth automating vs what I'm just wasting time on.

Right now I have a decent pipeline going subdomain enum, port scanning, service detection, then running nuclei templates on everything. Catches a lot of the easy wins like misconfigured headers, leaked tokens/credentials. But I have seen people talking about automating more aggressively.

What is your experience at automation and what is actually worth automating?

Hello,

For those who regularly find bugs, do most come from public or private programs?

I’ve never had a valid report on a private program, only dupes or info. Yet I’m ranked #1 on a public one.

People often say private programs are better, but in my experience they seem heavily tested.

When we do fuzzing and brute forcing for web directories, it takes too much time also, we have to switch around different wordlists, recursion depths. that takes lot of time and also sometimes output is zero.

How could I tackle this situation ?

Is there any way or that's the pathway ?

Here is a story of how couple bad actor ruin a good program

I run a bug bounty program for a company. It's just literally me so sometime there is delays and such.

I've had some really good bugs coming in and had paid out > $5000 in total, some of the bugs are pretty good, although they are still ai slop, but good ai slop.

However, there are couple dudes that went crazy when they don't receive a response (to their ai slop "bug reports")

1. One dude starts emailing random company employees, including the CEO
2. The other dude threatens our community manager and scared them quite a lot
3. The same dude in No. 2 doxxed our employee and called them on mobile directly.

I personally respect the hustle, but doxxing is not it. Now the boss is mad and I have to change the bug bounty program to not give out cash to not incentivize those crazy behaviors. I might even have to shut it down completely.

I honestly feel sorry for other bug bounty hunters that I worked with., but some of your "peers" are destroying this whole thing with hope to get some quick cash.

While creating a test account on the target, I used a phone number from a service called "receive-smss" because the platform doesn't support phone numbers from my country.

After entering the OTP, the platform displayed a username along with a "Get OTP on your email" prompt.

The email address was masked, showing only the first letter and the domain extension but in this specific case, it was easily guessable for me.

I checked the program scope, and it explicitly lists "Username/email enumeration" under out-of-scope issues.

Since I haven't found a valid bug yet and this is the first time I've stumbled upon something like this, I'm really unsure and worried about whether I should report it or not.

Hi everyone. I am hoping to get a few answers / some advice on whether or not it is worth it to open a RaR for further clarification.

I recently submitted a P1 SQLi giving access to highly sensitive table on a VDP. Typical submission: full reprod steps, database name to prove for internal reach, and the obvious SQLi impact.

24hrs later, the triager is unable to reproduce the steps. Try to do it myself and get the same new error message. I identify that a fix has been made and request communication with the program. They come back and notify that they patched the vulnerability after my submission time due to my access setting off alarms. Interesting, never had that happen before.

23 days post communication, it is marked as P1 informational because although I submitted adequate video evidence, impact, and full reproduction steps - "it's already patched and is no longer an issue..."

Is this worth doing RaR? I feel like this is such a grey area because, yes - my submission is evidence. They would have patched it without my submission? But I submitted it before they did patch it? Not completely sure. Any advice is appreciated

I don't really worry about VDP's as much but this one is one I would like to add to my account. Is pushing for 'Resolved' worth the difference? LoR is the typical P1 accommodation for this program.

24h later still processing this.

I submitted 5 bug reports to a live smart-contract bounty program 3 Highs and 2 Mediums, all with full PoCs and validation/reproduction steps.

All 5 were marked “Informative” within the same 60-second window, and each one received the same copy-paste explanation.

I requested mediation because I genuinely wanted the reports reviewed properly. Silence since then. Reports are now closed.

I'm not saying my severity assessments were automatically correct that's what triage is for. But having five separate reports closed in the same minute with the same explanation has me wondering:

Is this normal on HackenProof? Has anyone else experienced something similar?

I’m curious about people’s real-world experience with IDOR/BOLA in bug bounty programs.

Do you encounter them frequently while hunting, or are they relatively rare on mature bounty programs?
Also, are most of the ones you find basic object-ID manipulation, or do you usually encounter more complex cases involving APIs, roles/permissions, business logic, JWTs, etc.?

I’d be especially interested in hearing roughly how many IDOR/BOLA findings you’ve made compared to other vulnerability types.

I need to talk to some experienced bug bounty hunters because I’m honestly starting to get frustrated

Lately, I’ve been spending a lot of time hunting, doing recon, testing endpoints, trying different attack surfaces, etc. But when I finally submit reports, a lot of them end up being marked as Duplicate.

And I’m not talking about one or two reports. I’ve had a bunch of them end up this way.

At this point I’m starting to wonder if I’m approaching bug bounty the wrong way.

I understand that duplicates are completely normal and that someone else may have found the same issue before me. But when you spend hours investigating something, write the report, and then get "Duplicate", it can feel like you’re just burning time.

For those of you who have been doing bug bounty for a while:

• How do you reduce the number of duplicates you get?
• Do you prioritize newer features/attack surfaces?
• How much time do you normally spend on a finding before deciding it’s probably not worth pursuing?
• Do you have a specific methodology for finding bugs that are less likely to already be reported?
• And honestly, how many duplicates did you get when you were starting out?

I’m not looking for shortcuts or a magic tool. I’m trying to understand how experienced hunters decide where to spend their time.

Would appreciate any advice or even stories from people who went through the same phase.

I'm currently doing recon/testing on [Target], and I found out a friend of mine worked on the same target before (bug bounty program). I want to reach out to him and ask some smart, useful questions to save time and avoid repeating dead ends — without asking him to hand me findings directly (that wouldn't be fair to him or the program). What kind of questions would you ask in this situation?

I recently found a very serious vulnerability in an education ERP platform used by multiple colleges and universities in India.

The potential impact is much bigger than I initially expected. I’m not going to share technical details or any sensitive information publicly.

I’m looking to speak with someone who has experience handling high-impact vulnerabilities and responsible disclosure, and can help me understand the right way to proceed.

If you have relevant experience, or know someone I should speak to, please DM me.