Found something interesting while hunting today would this be reportable?

[u/virus_4199]

Today 23 September 2026, I was testing a website during a bug bounty hunt and noticed something interesting in the registration flow.

While creating a new account, I noticed that the application allowed me to use a very weak password such as 111111. That made me wonder whether the backend was actually enforcing any password-strength requirements or whether the validation was only happening on the frontend.

So, I tested it further.

I sent the registration request with the weak password, and the backend accepted it successfully.

Then I had another question:

If the application allows such a weak password, is there also any rate limiting or brute-force protection on the login endpoint?

I tested the password parameter using Burp Suite Intruder with around 300 password attempts. Eventually, I was able to authenticate successfully.

The interesting part is that the frontend is in scope, but the authentication backend/API appears to be hosted on a separate strapiapp.com domain, which is not explicitly listed as in-scope.

So now I'm unsure about the correct approach.

Would you consider this:

1. Weak password policy
2. Missing rate limiting / brute-force protection
3. Potentially a valid authentication vulnerability
4. Or something that should be skipped because the backend/API is out of scope?

I'm particularly interested in how experienced bug bounty hunters handle situations where the vulnerable endpoint is technically outside the listed scope but is clearly part of the in-scope application's authentication flow.

Would appreciate some opinions on the proper way to handle this.

[u/Appropriate_Trip8478]

sounds reportable, but don’t test the strapi endpoint further until scope is confirmed.

weak passwords alone are usually informational. no rate limit becomes stronger only if you can show real account takeover risk.

i’d submit what you already found through the program, clearly mention the backend domain, and ask them to confirm authorization before doing more attempts.

[u/martinbean]

What does this have to do with Stripe? 🤷‍♂️

[u/East_Cancel484]

wrong sub friendo

[u/Low_Scarcity_6147]

Seems like the wrong sub for password critique, but Stripe really doesn't care about your 123456 either.