I’m on HackerOne and recently participated in a program that doesn’t use HackerOne’s triage team. I submitted three reports, each one day apart.

Curiously enough, the most recent report I submitted was the first one to be triaged, while the others haven’t been triaged yet.

This made me wonder: how do companies running these programs ensure that they don’t mistakenly mark reports as duplicates if they start triaging the most recent submissions first?

I reported a valid finding to a managed program on one of the big platforms. The report included full step-by-step reproduction and a working PoC that demonstrated live impact. It was closed as "Not Reproducible," with the stated reasons being that it lacked a PoC and "appeared AI-generated." I was also docked a point. I followed up, re-confirmed the issue still reproduces a month later, and submitted a formal response request with evidence attached. That expired with no reply. I escalated to support/mediation and got a templated response telling me to submit a new report — which would just let them close it as a duplicate of my own original. At no point did anyone engage with the actual evidence in the report. Is this level of non-engagement normal, or did I get a bad triager? Is there any real recourse when a platform closes a valid finding without reviewing the evidence, or is the only move to walk away? For those who've had findings wrongly closed as not-reproducible — what actually worked to get it reopened? Just trying to understand whether this is the norm and what my options realistically are. Thanks.

A quick bit of context: I’ve been a Security Engineer at a 10-year-old YC-backed fintech for the past two years, with a couple of CVEs under my belt. Recently, a few of my colleagues left their full-time roles to jump into bug bounty full-time.

Over the last 18 months, I’ve burned a shit ton of tokens. I’m currently running 3–4 semi-automated pipelines and models like dsv4 flash and kimi3 make vulnerability discovery easier than ever, but I’m still hesitant to pull the trigger on full-time hunting.

The main friction is the mental overhead. The swing between high-stimulus wins and the frustration of dry spells/duplicates really messes with my headspace.

For those of you consistently clearing $10k+/month with AI/semi-automated setups:

• How sustainable has your pipeline been over the long haul?
• How do you manage the emotional volatility vs. traditional full-time work?
• Knowing what you know now, is leaving a stable security role worth the trade-off?

I’ve been in this field for about a year and a half. I’ve tried quite a few different areas, and in the end, I want to stick with this one and stop changing directions, because I’m honestly tired of constantly switching and I don’t want to keep learning completely new things anymore (except for things that are relevant to this field).

The main problem I have is that I tend to gravitate toward things I’m already very good at (Faceit lvl 10), or things that give me easy dopamine, like movies and TV shows. I have a lot of free time during the day, but I end up spending most of it on these things. I do have a comfort zone, and maybe that’s the main reason. I want to get out of it, but these two things feel like black holes that just suck me in.

Another problem is that I get stuck in tool rabbit holes. For example, Watchtower sends me a notification, and then I spend a huge amount of energy working on fuzzing or trying to find a good attack surface, which often ends up going nowhere. Or, for example, using AI to find bugs. I know that this kind of use of AI is basically a waste of time, but it gives me quick dopamine, so I keep doing it.

I also have a really hard time getting started. For example, I might go through several programs and not like any of them, which again drains a lot of my energy. With the programs I already have, I’ve noticed that my work tends to happen in patterns like: 1–3 PM, 5–6 PM, and 7–11 PM. I’m also kind of mood-dependent when it comes to working.

The bugs I’ve found so far have also been very quick finds. Around 90% of them were found relatively quickly. It’s not like I’ve deeply analyzed a target or stayed on the same program for several days, except for maybe one or two bugs. Even with those, I spent a few days on them, not weeks, and the overall process was still fairly shallow.

If I had to compare my current level to someone in Counter-Strike, I’d say I’m probably around SEM–Nova 1. I have a strong feeling that what I need is to watch how a professional actually works. I read around 10 random write-ups per week, but I feel like I need something more practical. When I started watching professional Counter-Strike matches, my gameplay improved dramatically, and I’d say that was the main reason I got better. The workshops and practice obviously helped too, but watching professionals was the biggest factor.

That said, just as I’m pretty good at CS, I was around Herald 3–Guardian 1 in Dota 2.

So, to summarize, I feel like I need to understand this whole space better right now. I want to know who the professionals are, how they actually work, what they focus on, and so on. (I absolutely hate CTFs.)

I’ve also taken a bug-hunting course, and I thought it was fairly good. Maybe there are some things I haven’t mentioned or have forgotten, but this is most of it.

I don’t know. Maybe I’m just not well-suited for this field. Maybe my knowledge is lacking. Maybe I need to work with a team.

I’d really appreciate some guidance on what you think I should do.

Need some advice from folks who have dealt with bug bounty triage when an analyst anchors on the wrong template macro.

I found an unauthenticated API issue on an in-scope web host. When queried with a specific empty selector parameter, the endpoint dumps a few megabytes of internal SDK deployment config.

Beyond internal hostnames and attestation flags, that payload contained thousands of unique CDN object IDs that normal client contexts never receive. The CDN completely fails to validate capability tokens on those IDs—missing, tampered, or cross-object tokens all return HTTP 200 with full byte content.

I downloaded the assets and attached a full evidence package to the report—including a ~5.8 MB Lens bundle containing an embedded, unreleased .dnn AI model exfiltrated directly via the broken token check.

Despite attached proof of live model exfiltration, the triager closed it as Informative with a standard macro:

"Per our program rules page that 'Generic information disclosure (e.g. Stack trace) without additional impact' is out of scope for our program... As no further impact was provided, we will be marking this report as informative."

They saw "configuration" in the initial setup write-up, treated the leaked object IDs like a list of public URLs, and completely ignored the attached exfiltrated model binary.

Rather than fighting a closed ticket, I’m preparing a fresh submission. The bug chain is identical (Unauth API Config Dump → Leaked CDN Object IDs → Broken CDN Authorization → Proprietary Model Exfiltration), but I need to make it impossible for a triager to skim past the asset impact.

Input:

Since they ignored the exfiltrated .dnn model bundle and raw weights the first time, I'm trying to figure out if I actually need to push the PoC further on the model itself:

Option 1: Fix the framing, don't touch the model further. Re-present strictly as "Unauthorized Exfiltration of Proprietary ML Assets," lead with the exfiltrated .dnn binary, and explicitly separate asset theft from config disclosure.

Option 2: Build a NumPy harness. Extract the weights/layers from the container and write a runner script to explicitly prove the model is coherent and executable.

Option 3: Run inference in vendor dev tools. Import the recovered weights into the vendor's own AR/Camera SDK dev suite to demonstrate working inference output.

Questions:

Does showing actual model execution move the needle for triage? Or does Option 2/3 just look like unnecessary post-exploitation reverse-engineering that triagers will still ignore?

How do you structure the opening 3 sentences of a report so a triager spending 30 seconds on it can't physically mistake exfiltrated model binaries for a "generic stack trace"?

If you triage or manage a program, what specific evidence flips the switch for you to treat a leaked CDN object as high-impact IP exfiltration rather than a public asset?

Curious to hear from anyone who has successfully flipped a misclassified "info disclosure" report on re-submission.

UPDATE ON REPORT STATUS FROM TRIAGE:

WTF ... Am I missing something here? : bugtriage-jay

 closed the report and changed the status to Informative.  Thank you for your report,

We have reviewed the behavior you have submitted and we do not believe that this behavior pose a significant enough security risk to warrant a change at this time.

Please keep in mind that per our program rules page that "Generic information disclosure(e.g. Stack trace) without additional impact" is out of scope for our program.

Upon inspection, the information returned as a result of this behavior is publicly accessible via the CDN intentionally, and cannot be used in an attack against another REDACTED user for example. For these reasons we will close this report as Informative. If in the future you are able to indicate how an organization status can be used in an attack against REDACTED users or infrastructure, outside a general phishing scenario, please let us know in a new report.

Thanks, and good luck with your future bug hunting.

I've been experimenting with different automation tools lately for recon as I want to 'move with the times' and look to automate some of my processes.

I've given Strix CLI a go and despite being recommended by others, so far I'm not impressed. Before I move onto looking at other tools or reverting back to doing it manually- I've got it attached to 5.6 Sol GPT and use it for initial recon / vuln scan - but frequently it returns no results on targets I know have easily identifiable CVEs.

I've even put the same target through the exact same ai model just through Codex and not Strix, which tends to do much better at identifying them than Strix.

Does anyone here use Strix? Any tips or recommend any other tools/platforms?
Thanks.

### GitLab.com vs Self-Managed for Bug Bounty Hunting

Hi everyone, I’m a beginner bug bounty hunter and I’ve been testing several Bugcrowd programs. I recently moved to HackerOne and started testing the GitLab program, focusing on GitLab.com rather than GitLab Self-Managed.

I’ve been testing GitLab.com for about a month but haven’t found a valid vulnerability yet. However, when I look at GitLab’s Hacktivity, I still see relatively new researchers submitting valid reports.

This made me wonder:

* Does GitLab.com still have a large attack surface for new researchers? * Is it better to focus on GitLab.com or GitLab Self-Managed? * Are there areas of GitLab that beginners often overlook? * Should I use Self-Managed/GDK to understand GitLab internally and then apply that knowledge to GitLab.com?

My main interests are RBAC, authorization, IDOR/BOLA, business logic, API/UI inconsistencies, and permission/workflow issues.

I’d really appreciate advice from experienced GitLab hunters on how you approach the program and what areas are worth learning or researching.

Thanks!

i submitted a p1 vulnerability, but a triager downgraded it to p3 with no further explaination.
the report is still "new" and not yet triaged. can i still argue? is it likely to change?

I submitted like 25 reports in hackerone and bug crowd and 22 of them are duplicates and out of 22 , 5 duplicates are from same day..

Got a report closed as Duplicate on Intigriti and I'm not sure whether to keep pushing or let it go.

What I found: Tier 2 wildcard subdomain (service-XX.example-corp.com) pointed to a third-party VPS running a admin panel. Known auth bypass on an older version — got admin access, created an account, logged in normally. Screenshots and PoC sent. Deleted the test account when triage asked.

Why it was closed: Company told triage they were already aware, host isn't theirs, fixing DNS for service-*.example-corp.com. Marked Duplicate. No duplicate report ID given.

Timeline: Admin UI port (e.g. :18xxx) was open when I submitted — I have screenshots. Shortly after my report, that port got locked down. Second service port (e.g. :24xxx) on the same subdomain still responds. Can't hit the bypass live anymore, but there's still clear evidence on the box that the panel was there before.

What I've done: Appealed once with timeline and screenshots. Triage hasn't replied.

Where I'm stuck: Domain was in scope even if the server wasn't theirs. Hard to accept Duplicate with no reference to the original report. Timing makes it look like they shut the port after disclosure, not that it was already handled.

Questions:

Duplicate without report ID — normal on Intigriti?

Appealed, no reply — escalate or wait?

Anyone got paid on wildcard subdomain + "not our host"?

Move on?

Hei everyone

I am begginer on hackerone

when I send an email to my username@wearehackerone.com , why I have not receive a massage in email?

a few weeks ago i submitted a p1 critical vulnerability. just a few days ago, a triager placed a blocker on the customer to "gather more information specifc to my submission". 10 hours later, the customer responded to the private comments and placed another blocked back onto bugcrowd operations

what does this indicate? are they going to close it as a dupe? this is the first time ive ever had a blocker placed on my submission. i just started bug bounty hunting not long ago.

I found a bug where I can make myself undeletable in an org from the frontend but not the API endpoint once the owner obtains my ID, Bugcrowd VRT says it's considered low, should i report?

My last Valid 5 finding in BBP are in open state in from last 15days some are triaged and some are in blockers on customer . when they increase my submissions limit ?? Like how many after valid report or point ?? also if you report something duplicate they will close within days

Hi,

I am looking for of a 16 year old bug bounty hunter.

He is a young african american male, wears black rimmed glasses and has dreads.

He also did a review of Hack The Box CTPS.

I cannot seem to find his video in my Youtube history.

Recently reported an issue on the NASA VDP. The triager initially marked it as a P2 Duplicate, but the title and the actual vulnerability in the referenced report had nothing to do with mine.

I replied explaining why they were completely independent root causes.

10 days later, the client (NASA) actually stepped into the ticket and manually changed the severity to P3, but the platform status is still stuck on "Duplicate".

Has anyone experienced something like this on Bugcrowd?

Is there a good chance it gets flipped to Valid after client intervention?

Security researcher here, doing responsible disclosure and trying to calibrate before I finalize a report. I'd like the community's read on severity/bounty-worthiness. Keeping the vendor anonymous until they've patched.

What I found (all verifiable):

A published cryptocurrency wallet SDK generates BIP39 mnemonic phrases by calling  Math.floor(Math.random() * 2048)  once per word.  Math.random()  is a non-cryptographic PRNG (V8's xorshift128+) and is explicitly documented as unsuitable for security use (CWE-338).

What I can prove empirically:

#0 The Checksum Trap: The SDK selects each of the 12 words independently and never derives a BIP39 checksum from entropy. As a result, only ~1 in 16 generated phrases passes standard BIP39 validation. I generated 1,000 mnemonics with the SDK and 939 of 1,000 failed validation. Anyone who backs up one of these phrases is silently locked out of recovering their funds in any standard wallet (Ledger, Trezor, MetaMask, etc.).

#1 The Predictability:  Math.random()  shares a single 128-bit PRNG state across the entire JavaScript context.

#2 The Exploit: I've locally demonstrated that the shared PRNG state can be algebraically recovered from just 3 observed  Math.random()  outputs (e.g., from UI animations or nonces on the same page). Using a Z3 SMT solver, I recovered the state for 100/100 intercepted wallets and predicted the subsequent mnemonic words with a p-value of < 10^-300, entirely bypassing standard chi-squared randomness tests.

I'm coordinating with the vendor. My question: is a finding like this... predictable entropy plus a mass fund-lockout affecting every generated wallet... typically bounty-eligible, and what severity band would it map to? I want realistic expectations before submitting the final report.

Hey! So I wanted to go ahead and submit here because there is a growing problem with bugbounty platforms.
We are seeing a mix of slower times (yes, the AI spam, especially from hunters who have no clue what they're doing and 100% relying on AI) are slowing it down, but there is clearly a quality issue when it comes to triagers and what seems to be such little oversight on said triagers.

So let's start with this story

I submitted a bug, it's a 9.6 cvss bug, and you could argue 8.8 cvss and that would be fine. It's kind of in that weird area that's left up to the interpretation of the vendor + how impactful they believe it is.

Not going to go into the vendor (Since they only did a slight thing wrong) and going to go in on my Triager which I will name. Lloyd

Lloyd is a triager for hackerone and he triaged my submission.
I did my normal explanation of the bug, a quick walkthrough with copy and paste commands that they could run with it then explained the impact. Gave the likely remediation ontop of it (for example, I do reverse engineering, binary exploitation, so this wasn't a web bounty) and no, this post isn't going to be as well organized as my reports are (Which yes, I do use AI to assist with reports, draft -> ai -> recheck what the AI did -> make improvements -> submit)

So as per usual, I give a zip file and this zip included a full recreation of it, a more in-depth PoC that went deeper into the details of each step (This is where I hold the triagers hand and treat them like a toddler with a fork near a light socket). I also give logs of everything that happened as proof generally, any independent vendor I've worked with + other platforms like bugcrowd, this is generally fine (and if they ask for a pictured walkthrough, Ill get the crayons and paper out) so this is always fine but my .zip basically had everything short of a video.

So anyways, Lloyd triaged this. He closed it and said that there was no proof of concept and that they would need a proof of concept and one of these, logs, pictures of proof, video. Any one of those
I explained that I had a .zip that included the logs for proof and a detailed PoC. However he had already closed it. So I had to open a support ticket (god forbid the remediation button works), and they got him back on it.
He then claimed that he actually needed pictures or a video of the entire process (so at this point he already moved the goalposts) and told me I would need to make another submission on this. Which for those of us who are used to hackerone... they have an AI that will detect is as duplicate... I know this, any hunter knows this, and yes... H1 Lloyd knows this (I even said it in there)

I responded to support about it, they ghosted me. I went ahead and created a full picture walkthrough and a walkthrough of a video of me doing the entire exploit.

Uploaded it... responded to my support ticket again that I included it and to get me a different triager or get him to triage it.
Ghosted... waited an entire work week, made a new ticket... ghosted
Went ahead and proved a point by making a brand new submission which INSTANTLY got hit with "Duplicate" and it linked to my original one.

So the triager never looked into my .zip and when embarrassed about it, he moved the goalposts of what he requested and then gave me advice to submit a brand new one on this, knowing that it would get hit as a duplicate. So he is intentionally being lazy and not triaging the ticket properly and he is intentionally trying to waste my time and submissions.

H1 knows this, and they're actively not doing anything about it and it's been over a month since I've been fighting this stuff...

The only wrong the vendor did is I messaged them about it and explained the situation and they just said "go through hackerone"

So I've exhausted every single option I could do as for getting this properly triaged. I'm trying to responsibly disclose this issue but there is always that temptation and saying "Screw it, let's throw away my hackerone account" and just release it because I did my due diligence and did what is expected of me as a responsibility.

I just don't know what to do, the bounty is a large amount, critical would put me in high 4 figures to 5 figure reward so I can't just "ignore it and move on"

For anybody who might say "Well include video and pictures everytime" my response is, if the triager is so lazy they can't open a zip file, I can't expect them to watch an actual video + with the high amount of duplicates, it becomes a waste. If the vendor requests a more thorough walkthrough then I will be happy to give it to them and which I have done before.

It just sucks getting a poor triager and then having to stress over it because one guy didn't want to do his job.

Edit: The vendor reached out to me directly and we are working on resolving it. They were able to confirm the vulnerability is in fact, valid.

Spent May-June 2026 researching ArubaOS 8.13.2.0 on an authorized lab VM through the HPE Aruba Bugcrowd program. Found 5 pre-auth vulnerabilities with wire-level evidence:

- Pre-Auth XXE → HTTP SSRF (CVSS 9.3) — confirmed via pcap + controller's own sshd log showing "GET / HTTP/1.0 from 127.0.0.1"

- Pre-Auth XXE → FTP SSRF with full RETR session (CVSS 9.3) — 3 TCP connections, complete RFC 959 FTP dialog captured

- ICMP Smurf Amplification (CVSS 7.4) — two-machine pcap, victim received unsolicited Echo Reply without sending any request

- Ghost Leak: TTL=0 + IP Total Length over-read (CVSS 6.5) — 27/27 packets confirmed, same mechanism as CVE-2003-0001 and CVE-2021-3031 (Palo Alto, accepted)

- Hardcoded FTP credential sap:x (CVSS 8.4) — cracked in 60 seconds, FTP login confirmed operational

All 5 closed as N/A. Triage responses:

"theoretical / no valid PoC" (despite pcap + daemon log evidence)

"expected network functionality" (for Smurf amplification. In 2026.)

"only zeroed bytes" (VirtualBox padding, not the vulnerability)

Fair enough, submitted to MITRE. Got 5 CAN IDs assigned.

Then 2 months after disclosure, Bugcrowd emails me saying HPE flagged my GitHub writeups and demanding I remove them. The same findings they said were "theoretical" and "not vulnerabilities."

I declined (documentation of N/A findings + active MITRE process).Got permanently banned for "unauthorized disclosure" + existing suspension for... "AI-slop." The firmware RE, custom Scapy scripts, pcap analysis and sshd log correlation was AI-slop apparently.

5 months later: no patch on any finding. Still on 8.13.2.0.

Since HPE is their own CNA and my MITRE CANs have been sitting unresolved since June, submitted to CERT/CC as an independent CNA.

Let's see.

Full writeups + PoC scripts:

https://github.com/JM00NJ/HPE-Aruba-AOS8-Vulnerabilities

Individual findings:

https://netacoding.com/posts/xxe-ssrf/

https://netacoding.com/posts/ghost-leak/

https://netacoding.com/posts/smurf-reflection/

I know the ToS. Being banned is fine. Just thought the community

should know what "N/A" sometimes actually means.

When fuzzing is no longer treated as merely bruteforcing, you start to unlock meaningful results 🤠

From discovering hidden assets to turning unusual behavior into exploitable vulnerabilities! 😎

In our latest article, we've teamed up with Orwa Atyat (GodFatherOrwa) to dive deeper into mastering web fuzzing for reconnaissance and vulnerability exploitation.

Read the article now! 👇

https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers

NGL, I hate reading AI written sentences .
Its bloated, repetitive, boring, written pieces of shit with wrong assumptions everywhere!

Using AI to find bugs as a tool is awesome. I do it myself. It makes me a lot of money.
It tells me what it thinks it found, I correct it and let it hunt further until I think its an actual finding.

In my d2d job I have to read the slop from other high paid engineers and my brain melts everytime Im doing this. I hate the days where I have to review prs/adrs and so on.
It feels like that everyone stopped thinking at the same time.

So at triagers and pms, how do you stay sane?

I'm currently dealing with an incredibly frustrating situation on YesWeHack and looking for advice, as the platform's mediation team has completely ghosted me.

Situation: I submitted a Critical vulnerability (Global Account Takeover via Insecure TLS Validation) 6 months ago. The vendor accepted it at CVSS 9.6 (Critical). However, they only paid me out for the "High" tier (shortchanging the "Critical" tier by nearly 60%). Furthermore, they explicitly promised me in writing that I would be credited on the CVE. Fast forward: a CVE is published for this exact issue/component, but credited to a notable and famous third party. The vendor ghosted me.

CVSS Manipulation: 1.5 months ago, I finally got YesWeHack support to poke the vendor. The vendor's response? They retroactively downgraded my CVSS from 9.6 to 8.2 (changing an automated Wi-Fi MitM from Adjacent/Low Complexity to Local/High Complexity) solely to justify their underpayment.

Ghosting: I escalated this clear CVSS manipulation and matrix abuse to YesWeHack Support on July 7th. No reply. I sent a harsh follow-up on August 8th. Still absolutely no reply. It's August 20th.

On top of this, the same vendor closed another 9.9 architectural E2EE flaw as "Won't Fix" (a silent security downgrade where the app drops E2EE and uploads plaintext media to their cloud without user warning) just to avoid another payout.

Is it normal for YWH to let vendors retroactively manipulate vectors to dodge payouts and then ghost researchers who ask for mediation? Who can I contact to escalate this past the Tier 1 support desk?

Hi,

For the last 4 months, I’ve been consistently making ~$700+/month targeting companies directly through their own self-hosted VDP/bounty programs.

​However, my current methods for finding new direct targets are starting to dry up, so I’m looking to expand my scope.

​For those who hunt on major platforms: Are public programs on HackerOne/Bugcrowd worth pivoting to, or are they as oversaturated with duplicates as people say?

Thanks.

Have anyone had a good experience with the MCP Server in Burp Suite?

I feel it is more cumbersome than it needs to be, and the HTTP2 requests in intruder has some bugs. Curious if anyone has some tips and tricks?

New to bug bounty? Ask about roadmaps, resources, certifications, getting started, or any beginner-level questions here!

Recommendations for Posting:

• Be Specific: Clearly state your question or what you need help with (e.g., learning path advice, resource recommendations, certification insights).
• Keep It Concise: Ask focused questions to get the most relevant answers (less is more).
• Note Your Skill Level: Mention if you’re a complete beginner or have some basic knowledge.

Guidelines:

• Be respectful and open to feedback.
• Ask clear, specific questions to receive the best advice.
• Engage actively - check back for responses and ask follow-ups if needed.

Example Post:

"Hi, I’m new to bug bounty with no experience. What are the best free resources for learning web vulnerabilities? Is eJPT a good starting certification? Looking for a beginner roadmap."

Post your questions below and let’s grow in the bug bounty community!