L4ZZ3RJ0D·4h agoHow a Broken Email Confirmation Flow Took Over Any Shopify StoreReal chain this time, not one report but three linked ones, all from the same researcher, Ron Chan, who goes by ngalog on HackerOne. This…A response icon1A response icon1
Aliso·2d agoWhen a One-Time Password Works Twice: A Password Reset Logic FlawHow replaying a completed password reset request revealed a missing security boundary.
InMeetCyberbyRaj Namdev·3d agoThe Impact Section Is One Word. The Bounty Is $25,000.“SSRF.” was not minimalism. It was the endpoint of complete work.
0xdzubair·Oct 29CWE-540 in the Wild: Hardcoded Credentials in a Production Analytics ScriptA quick lesson in why “we’ll clean that up later” is the most dangerous sentence in software.
0xdzubair·Oct 29Pavel Thought robots.txt Was a Lock. It Was a Welcome Mat.A walkthrough of an information disclosure bug that didn’t need a single exploit — just curiosity and a text file.
Ankit Rathva aka Gujarati Hacker·Oct 29When OAuth Bypasses 2FA: Finding an Authentication MisconfigurationMulti-factor authentication (MFA) is an important security layer that helps protect user accounts even when passwords or other…A response icon1A response icon1
jimmy·Oct 27Title: The $0.00Subtitle: How I discovered a Price Manipulation vulnerability in a major SaaS platform, validated it, and learned a valuable lesson about…
InOSINT TeambyRahul Singh Chauhan·Oct 23Complete Guide on mTLS for Interviews and Penetration Testing — PART IIIn the previous article, we touched upon the basics of certificates, mTLS, x509 standard for certificates, along with public and private…
Yousef·Oct 22Security Write-Up: Authentication Bypass via Response Manipulation on Email Change Feature“وَمَا تَوْفِيقِي إِلَّا بِاللَّهِ ۚ عَلَيْهِ تَوَكَّلْتُ وَإِلَيْهِ أُنِيبُ”A response icon1A response icon1
InMeetCyberbyRaj Namdev·Oct 22Six Open-Source Bug Bounties Went Dark in 2026. It Wasn’t the Money.Discovery got industrialized. Remediation didn’t.
