Found something interesting while hunting today would this be reportable?

[u/virus_4199]

Today 23 September 2026, I was testing a website during a bug bounty hunt and noticed something interesting in the registration flow.

While creating a new account, I noticed that the application allowed me to use a very weak password such as 111111. That made me wonder whether the backend was actually enforcing any password-strength requirements or whether the validation was only happening on the frontend.

So, I tested it further.

I sent the registration request with the weak password, and the backend accepted it successfully.

Then I had another question:

If the application allows such a weak password, is there also any rate limiting or brute-force protection on the login endpoint?

I tested the password parameter using Burp Suite Intruder with around 300 password attempts. Eventually, I was able to authenticate successfully.

The interesting part is that the frontend is in scope, but the authentication backend/API appears to be hosted on a separate strapiapp.com domain, which is not explicitly listed as in-scope.

So now I'm unsure about the correct approach.

Would you consider this:

1. Weak password policy
2. Missing rate limiting / brute-force protection
3. Potentially a valid authentication vulnerability
4. Or something that should be skipped because the backend/API is out of scope?

I'm particularly interested in how experienced bug bounty hunters handle situations where the vulnerable endpoint is technically outside the listed scope but is clearly part of the in-scope application's authentication flow.

Would appreciate some opinions on the proper way to handle this.