# Bug Bounty A method of compensating individuals for reporting software bugs that might allow security exploitation or vulnerabilities. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Upcoming Next.js August Security Release DevFeed: [Upcoming Next.js August Security Release]() Original publisher: [Read original article]() Author: Sebastian Silbermann Published: 2026-08-20T18:00:00Z Content type: release Language: en Sources: [Next.js Blog]() Topics: [Next.js](), [Security](), [Vulnerabilities](), [Bug Bounty](), [Open Source](), [Vercel]() Tags: [bug-bounty](), [next-js](), [open-source](), [release](), [security](), [vercel](), [vulnerabilities]() ### AI overview Next.js is preparing a scheduled August 2026 security release addressing critical-severity vulnerabilities. The release is expected to include patched versions 16.3.3 and 15.5.24, with a full advisory and upgrade instructions. ### Source excerpt Next.js is preparing a scheduled August security release for August 26, 2026. ## How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees DevFeed: [How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees]() Original publisher: [Read original article]() Author: Chris Wiltz Published: 2026-08-12T13:00:28Z Content type: article Language: en Sources: [Engineering at Meta]() Topics: [End-to-End Encryption](), [Encryption](), [Machine Learning & Artificial Intelligence](), [Inference](), [Security](), [Bug Bounty](), [Social engineering]() Tags: [bug-bounty](), [encryption](), [machine-learning](), [privacy](), [scam](), [security](), [security-privacy](), [social-engineering](), [user-control](), [whatsapp]() ### AI overview An early technical overview of WhatsApp's optional Scam Alert feature, which uses a small on-device machine learning model to classify potential scam messages while keeping message content on the device. The article explains how the design preserves end-to-end encryption through local processing, avoids automatic reporting, gives users control, and supports independent security review during a limited Beta rollout. ### Source excerpt WhatsApp is committed to helping people stay safe while protecting the privacy of their messages. As scam tactics evolve -- from impersonation to social engineering to AI-generated lures -- we're always evolving as well, so that our protections stay ahead of scammers while protecting people's personal messages with end-to-end encryption. Today, we're sharing an early [...] Read More... The post How We're Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees appeared first on Engineering at Meta. ## Burp's new Ambassadors: learn from the people who use Burp Suite everyday DevFeed: [Burp's new Ambassadors: learn from the people who use Burp Suite everyday]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-07-17T13:35:25Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [web applications](), [Cybersecurity](), [Mobile Security](), [Bug Bounty]() Tags: [ambassador](), [application-security](), [bounty](), [bug-bounty](), [community](), [cybersecurity](), [mobile](), [security](), [testing](), [web]() ### AI overview PortSwigger introduces four new Burp Ambassadors and highlights their contributions to web application security, including research, education, penetration testing, bug bounty work, community events, and practical Burp Suite workflows. ### Source excerpt Growing our Burp Ambassador community Meet our newest Burp Ambassadors Katie Paxton-Fear Malek Mohammad Yogesh Tantak James Lester Looking ahead Interested in getting involved? Growing our Burp Ambass ## GPT-5.5 Bio Bug Bounty DevFeed: [GPT-5.5 Bio Bug Bounty]() Original publisher: [Read original article]() Published: 2026-07-09T10:00:00Z Content type: news Language: en Sources: [OpenAI News]() Topics: [Bug Bounty](), [Jailbreak](), [OpenAI](), [Frontier AI](), [Artificial Intelligence](), [ChatGPT]() Tags: [ai](), [bounty](), [bug-bounty](), [frontier-ai](), [gpt](), [jailbreak](), [models](), [openai](), [safety]() ### AI overview OpenAI is turning its GPT-5.5 Bio Bug Bounty into an ongoing private Bio Bounty Program focused on universal jailbreaks against biosafety challenges for frontier models. Rewards for qualifying GPT-5.5 and GPT-5.6 findings have increased from $25,000 to $50,000. ### Source excerpt Details about the OpenAI Bio Bounty program ## Chainguard Launches Bugcrowd Bug Bounty With Up to $200,000 in Rewards DevFeed: [Chainguard Launches Bugcrowd Bug Bounty With Up to $200,000 in Rewards]() Original publisher: [Read original article]() Published: 2026-07-06T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Bug Bounty](), [Security](), [Vulnerabilities](), [Exploit](), [npm packages]() Tags: [bounty](), [bug-bounty](), [bugcrowd-bug-bounty](), [chainguard-bug-bounty](), [chainguard-security](), [exploit](), [malicious-packages](), [npm-packages](), [security](), [security-contest](), [shai-hulud](), [supply-chain](), [vulnerabilities]() ### AI overview Chainguard is running a Bugcrowd bug bounty from July 6-27, offering up to $200,000 to researchers who find vulnerabilities in its infrastructure and products. ### Source excerpt Chainguard launches a Bugcrowd bounty with up to $200K in rewards, inviting researchers to test its infrastructure against real-world attacks. ## How I hunt for vulnerabilities with AI DevFeed: [How I hunt for vulnerabilities with AI]() Original publisher: [Read original article]() Author: Tsvetan Stoychev Published: 2026-06-26T11:24:26Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [Artificial Intelligence](), [Vulnerabilities](), [Bug Bounty](), [clickhouse](), [C++](), [Security](), [Code]() Tags: [ai](), [bug-bounty](), [c-plus-plus](), [claude](), [clickhouse](), [code](), [copilot](), [ctf](), [gemini](), [github-copilot](), [guest-post](), [security](), [vulnerabilities](), [vulnerability]() ### AI overview This guest post explains how an experienced software engineer used GitHub Copilot with Claude Opus and Gemini models to investigate vulnerabilities in the large C++ ClickHouse codebase. The workflow used AI to search code, generate hypotheses, and accelerate validation in local environments, leading to several real vulnerability reports. ### Source excerpt I'm an experienced software engineer, but I'm not a seasoned bug bounty hunter. I used GitHub Copilot in combination with Claude Opus and Gemini models to search for vulnerabilities in the ClickHouse codebase, generate hypotheses, and speed up validation. ## The Wonders of AI: We Are Retiring Our Bug Bounty Program DevFeed: [The Wonders of AI: We Are Retiring Our Bug Bounty Program]() Original publisher: [Read original article]() Author: Glauber Costa Published: 2026-05-12T00:00:00Z Content type: opinion Language: en Sources: [Turso Blog]() Topics: [Bug Bounty](), [Turso](), [SQLite](), [Maintainers](), [data](), [Software]() Tags: [bug-bounty](), [concurrency](), [data](), [maintainers](), [sqlite](), [testing](), [turso]() ### AI overview Turso is retiring its $1,000 data-corruption bug bounty after an influx of low-quality pull requests overwhelmed maintainers. The article explains the tension between keeping an open contribution model and protecting review capacity, while outlining Turso's extensive testing practices and their limits. ### Source excerpt For almost a year now, Turso has had a program that pays $1,000 for any bug that can be demonstrated to lead to data corruption. Today, we are retiring this program. ## Rails Security, AI, and IBB DevFeed: [Rails Security, AI, and IBB]() Original publisher: [Read original article]() Published: 2026-05-06T17:31:54Z Content type: opinion Language: en Sources: [Aaron Patterson]() Topics: [Rails](), [Artificial Intelligence](), [Bug Bounty](), [Security]() Tags: [ai](), [bug-bounty](), [rails](), [security]() ### AI overview A Rails team member reflects on the Internet Bug Bounty program, describing how AI-generated low-quality security reports overwhelmed the team and contributed to the program stopping new submissions and bounty payments. The change also removed incentives for legitimate researchers and left Rails handling payment-related questions. ### Source excerpt For quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects participating in the IBB. For quite a while I wasn't certain about my feelings toward the program because I felt like cash rewards could incentivize low quality reports as well as encourage reporters to "haggle" about the severity of a particular bug (the IBB paid more when the bug was more severe). In the beginning that certainly was the case. We were fielding many low quality reports, and people were haggling over severity. But the program evolved, and despite the never-ending haggling, I felt it did more good (rewarding security researchers) than bad (forcing the security team to wade through low quality reports). That is, until AI came along. Sometime in 2025 our team started getting inundated with low quality AI generated reports. I know for sure this wasn't unique to just our team as well. Anyway, AI lowered the barrier to generate reports, so we were back in the era of wading through low quality reports. Only this time, the low quality reports were masquerading as high quality reports. AI made it easy to turn a bullshit problem into something that looked legit, and since there's a possibility of money involved people tried to take advantage of the situation. We even had a report where someone forgot to delete the AI generated output and just uploaded the report as-is with the following text: ## ✅ READY TO SUBMIT! *All information prepared for professional Rails bug bounty submission.* *Expected Outcome:* Rails Team Response: 1-2 weeks Fix Development: 2-8 weeks Security Release: 8-12 weeks IBB Bounty: $1,040-1,600 (80% of $1,300-2,000) *Next Step:* Copy information above into HackerOne form and submit! I enjoy using AI, but I really don't like AI being used on me. But that's not what this post is about. Recently the IBB stopped accepting new submissions. In other ## PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses DevFeed: [PortSwigger partners with Meta Bug Bounty to empower bug hunters with training and Pro licenses]() Original publisher: [Read original article]() Author: Fran Hutchings Published: 2026-04-07T12:12:07Z Content type: release Language: en Sources: [PortSwigger Blog]() Topics: [Bug Bounty](), [Application Security](), [Web](), [Meta](), [Tooling]() Tags: [accessibility](), [bounty](), [bug-bounty](), [collaboration](), [education](), [meta](), [partners](), [security](), [tooling](), [training](), [web]() ### AI overview PortSwigger announces a partnership with Meta Bug Bounty to provide eligible bug hunters with training, learning pathways, and Burp Suite Professional licenses. The initiative aims to improve testing efficiency, help researchers identify high-impact vulnerabilities, and strengthen the global security research community. ### Source excerpt More power for bug hunters An education-first approach to bug bounty Rewards on Meta's Bug Bounty Platform Our shared vision Ready to get started? We're excited to announce a new partnership with Meta ## Security Bug Bounty Program Paused Due to Loss of Funding DevFeed: [Security Bug Bounty Program Paused Due to Loss of Funding]() Original publisher: [Read original article]() Published: 2026-04-02T12:00:00Z Content type: news Language: en Sources: [Node.js Blog]() Topics: [Bug Bounty](), [Node.js](), [Security](), [Vulnerabilities](), [Open Source]() Tags: [bug-bounty](), [developers](), [node-js](), [open-source](), [security](), [vulnerabilities]() ### AI overview Node.js has paused its security bug bounty program because the external funding source for monetary rewards was discontinued. Security reporting through HackerOne continues, but vulnerability reports are no longer eligible for bounty payouts. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## VRP 2025 Year in Review DevFeed: [VRP 2025 Year in Review]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2026-03-31T16:55:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [Bug Bounty](), [Google](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Chrome](), [Open Source]() Tags: [ai](), [bounty](), [bug-bounty](), [chrome](), [dependencies](), [google](), [none](), [open-source](), [security](), [vulnerabilities]() ### AI overview Google's 2025 Vulnerability Reward Program review marks its 15th anniversary and reports more than $17 million awarded to over 700 security researchers. It also describes a dedicated AI VRP, expanded Chrome rewards for AI-related issues, OSV-SCALIBR patch rewards, and security community events. ### Source excerpt Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe - across all of our programs. Vulnerability Reward Program 2025 in Numbers Want to learn more about who's reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site. VRP Highlights in 2025 In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: The new, dedicated AI VRP was launched, underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. Similarly, the Chrome VRP now also includes reward categories for problems found in AI features. We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulne ## Keycloak's Bug Bounty Program on YesWeHack DevFeed: [Keycloak's Bug Bounty Program on YesWeHack]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-01-16T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Bug Bounty](), [IAM](), [Cloud Native Ecosystem](), [Open Source]() Tags: [bug-bounty](), [cloud-native-ecosystem](), [eu](), [iam](), [idm](), [kerberos](), [keycloak](), [ldap](), [open-source](), [openid-connect](), [saml](), [sso]() ### AI overview Keycloak announces its public bug bounty program on YesWeHack as part of an EU-sponsored initiative. The program is currently paused while submissions are reviewed after receiving many submissions. ### Source excerpt As a Cloud Native Computing Foundation (CNCF) project, Keycloak is the open-source IAM backbone for countless applications. This is your chance to secure a core piece of the cloud-native ecosystem in this public bug bounty program!. We are proud to be part of this EU sponsored initiative. Projects like ours fuel a lot of public and private infrastructure in the EU and worldwide. Thank you for choosing our project for this initiative to help us to improve and provide secure services to our users! We received a lot of good submissions to the program. While we sort out the submissions, the program is paused. ## The future of pentesting is Human x AI, and it's already in Burp Suite Professional DevFeed: [The future of pentesting is Human x AI, and it's already in Burp Suite Professional]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-10-07T13:17:41Z Content type: opinion Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Security](), [Testing](), [Automation](), [Bug Bounty](), [account takeover]() Tags: [2025](), [account-takeover](), [ai](), [ai-tools](), [automation](), [bug-bounty](), [security]() ### AI overview The article argues that AI-assisted penetration testing is already widespread, while human expertise remains essential. It presents Burp AI in Burp Suite Professional as a human-controlled tool for summarizing data, iterating payloads, scaffolding proofs of concept, and helping testers identify complex vulnerabilities such as account takeover. ### Source excerpt The latest Hacker-Powered Security Report from HackerOne makes one thing clear: AI-assisted pentesting isn't a future trend; it's today's reality. In HackerOne's 2025 report, 70% of surveyed researche ## Hacking smarter with Burp AI: NahamSec puts Burp AI to the test DevFeed: [Hacking smarter with Burp AI: NahamSec puts Burp AI to the test]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-10-01T14:31:40Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Hacking](), [Bug Bounty](), [AI Infrastructure]() Tags: [ai](), [ai-infrastructure](), [bug-bounty](), [features](), [free](), [hacking](), [video](), [youtube]() ### AI overview NahamSec demonstrates how Burp AI fits into a real bug bounty and security testing workflow, including Repeater, Scanner follow-up, and recorded logins. The AI features run on demand within PortSwigger's secure AI infrastructure. Burp Suite Professional users receive 10,000 free AI credits. ### Source excerpt Bug bounty legend, NahamSec, has taken Burp AI for a spin. If you're curious how Burp AI fits into a real workflow, his new video is the perfect place to start. Watch on YouTube Burp AI was built to a ## How to join the desync endgame: Practical tips from pentester Tom Stacey DevFeed: [How to join the desync endgame: Practical tips from pentester Tom Stacey]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-09-18T15:51:39Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [HTTP](), [Vulnerabilities](), [Exploit](), [Bug Bounty](), [Testing]() Tags: [bounty](), [bug-bounty](), [guest-post](), [http](), [research](), [techniques](), [testing](), [vulnerabilities]() ### AI overview This guest post presents practical guidance for joining research into HTTP/1.1 desynchronization vulnerabilities. It discusses HTTP Request Smuggling, two novel desync vulnerability classes, their impact on major CDNs, bug bounty opportunities, and a newer scanning technique intended to identify request-boundary problems. ### Source excerpt Note: This is a guest post by pentester and researcher, Tom Stacey (@t0xodile). You'd think that after almost 21 years since its initial public discovery, HTTP Request Smuggling would be barely exploi ## Ethereum Announces Four-Week Fusaka Audit Contest DevFeed: [Ethereum Announces Four-Week Fusaka Audit Contest]() Original publisher: [Read original article]() Author: Ethereum Protocol Security Research Team Published: 2025-09-15T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Vulnerabilities](), [Security](), [Ethereum](), [Bug Bounty]() Tags: [bounty](), [bug-bounty](), [ethereum](), [security](), [security-platform](), [smart-contract](), [vulnerabilities]() ### AI overview Ethereum has launched a four-week audit contest for the Fusaka upgrade, hosted on Sherlock and co-sponsored by Gnosis and Lido. The contest is intended to identify vulnerabilities before they affect the network, with time-limited point multipliers for early valid findings. ### Source excerpt Today, we are excited to announce the start of the Fusaka audit contest, co-sponsored by Gnosis and Lido, hosted on Sherlock, and running for four weeks from September 15th. The goal is simple: maximize scrutiny of the Fusaka upgrade and surface vulnerabilities before they can impact the network. To... ## How this seasoned bug bounty hunter combines Burp Suite and HackerOne to uncover high-impact vulnerabilities DevFeed: [How this seasoned bug bounty hunter combines Burp Suite and HackerOne to uncover high-impact vulnerabilities]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-09-12T12:21:38Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Bug Bounty](), [Security](), [Vulnerabilities](), [web applications](), [API](), [Extension](), [Networks]() Tags: [api](), [attacks](), [bug-bounty](), [extension](), [http](), [networks](), [security](), [testing](), [vulnerabilities](), [web-applications]() ### AI overview The article profiles Tess, a full-time bug bounty hunter who combines Burp Suite Professional with HackerOne to discover, document, and report high-impact web security vulnerabilities. It describes how Burp Suite exposes backend requests, supports API testing, and provides evidence for triage, including a $38,000 Zoom bounty involving HTTP request smuggling. ### Source excerpt Arman S. (Tess), a full-time independent security researcher and bug bounty hunter, talked us through how he uses Burp Suite Professional and HackerOne in tandem to find and report high-value security ## HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle DevFeed: [HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-08-05T11:08:29Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [HTTP](), [Application Security](), [Vulnerabilities](), [servers](), [Bug Bounty](), [web applications]() Tags: [atlassian](), [bug-bounty](), [developer](), [discord](), [http](), [netflix](), [security](), [video](), [vulnerabilities]() ### AI overview The article presents a video in which NahamSec and James Kettle explain HTTP request smuggling, a vulnerability class caused by differences in how front-end and back-end servers interpret HTTP headers. It covers attacks such as session hijacking, cache poisoning, HTTP/2 downgrades, and browser-powered desynchronization, along with real-world cases involving Netflix and Atlassian. ### Source excerpt Ever wondered how attackers can compromise modern websites by exploiting invisible cracks in HTTP infrastructure to win big bounties? In his latest video, NahamSec walks through the basics of request ## Bypassing character blocklists with unicode overflows DevFeed: [Bypassing character blocklists with unicode overflows]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-01-28T13:58:28Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [ASCII](), [JavaScript](), [Bug Bounty]() Tags: [2025](), [ascii](), [attacks](), [bug-bounty](), [javascript](), [published]() ### AI overview The article explains how Unicode codepoint truncation, or Unicode overflow, can bypass character blocklists by producing specific ASCII characters when values exceed byte or JavaScript codepoint limits. It describes active use of these truncation attacks by bug bounty hunters and related tooling added to ActiveScan++, Hackvertor, and Shazzer. ### Source excerpt Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo ## Bugbounty and Pentests at Neon DevFeed: [Bugbounty and Pentests at Neon]() Original publisher: [Read original article]() Author: Busra Demir Published: 2024-11-25T16:43:38Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [Bug Bounty](), [Security](), [Cybersecurity](), [Vulnerabilities](), [Serverless](), [Open Source](), [Database](), [Authentication](), [tenant data protection](), [API]() Tags: [api-security](), [authentication](), [bounty](), [bug-bounty](), [company](), [cybersecurity](), [data-protection](), [launch](), [open-source](), [partnership](), [platform](), [privacy](), [production](), [security](), [serverless](), [vulnerabilities]() ### AI overview Neon announces a private Bug Bounty Program in partnership with HackerOne and describes three penetration tests that identified and resolved 58 vulnerabilities. The program covers authentication, data protection, API security, production, and staging environments, with rewards based on severity and defined response targets. ### Source excerpt At Neon, security is at the core of everything we do. Our serverless platform was built with a vision for innovation, but we also know that a commitment to security is paramount. That's why we're excited to announce the launch of our Neon's Bug Bounty Program in partnership with... ## Ethereum Protocol Attackathon in Collaboration with Immunefi DevFeed: [Ethereum Protocol Attackathon in Collaboration with Immunefi]() Original publisher: [Read original article]() Author: EPS Research Team Published: 2024-07-08T00:00:00Z Content type: release Language: en Sources: [Ethereum Foundation Blog]() Topics: [Ethereum](), [Security](), [Vulnerabilities](), [Bug Bounty]() Tags: [announce](), [audit](), [collaboration](), [community](), [competition](), [developers](), [ethereum](), [event](), [protocol](), [security]() ### AI overview The Ethereum Protocol Security Research Team announces the first Ethereum protocol Attackathon, a four-week crowdsourced security audit competition hosted by Immunefi. The event includes an educational phase, vulnerability research under competition rules, and a later report of findings. ### Source excerpt The Ethereum Protocol Security (EPS) Research Team is pleased to announce the launch of the first Ethereum protocol Attackathon, hosted by Immunefi. This four-week event aims to enhance the security of the Ethereum protocol through a large-scale crowdsourced security audit competition. Our goal is to raise over 2 million USD... ## Using form hijacking to bypass CSP DevFeed: [Using form hijacking to bypass CSP]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2024-03-05T14:55:00Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Security](), [vulnerability](), [passwords](), [HTML](), [Bug Bounty](), [Chrome](), [Mastodon](), [Google]() Tags: [bug-bounty](), [chrome](), [csp](), [how-to](), [html](), [infosec](), [password](), [report](), [security](), [vulnerability]() ### AI overview This article explains how form hijacking can bypass Content Security Policy when a site has an HTML injection vulnerability and fails to restrict form actions. Injected forms or form-action attributes can send credentials to an attacker, with password managers potentially autofilling the fields. It discusses real-world examples, CSP configuration mistakes, and Burp passive scan checks for related issues. ### Source excerpt In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re ## 7 tips to become a successful bug bounty hunter DevFeed: [7 tips to become a successful bug bounty hunter]() Original publisher: [Read original article]() Author: Ben Sadeghipour Published: 2024-01-25T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Bug Bounty](), [Vulnerabilities](), [Security](), [Hacking](), [web applications]() Tags: [ambassador](), [awareness](), [blog](), [bug-bounty](), [code-security](), [developer](), [hacking](), [open-source-security](), [security](), [snyk-security-intel](), [sql](), [tech](), [testing](), [vulnerability](), [vulnerability-disclosure](), [web-applications](), [xss]() ### AI overview This article explains bug bounty hunting, including how security researchers identify and responsibly report vulnerabilities in web applications, IoT devices, mobile applications, and smart contracts. It distinguishes vulnerability disclosure programs from bug bounty programs and recommends that beginners start with a Vulnerability Disclosure Program before pursuing paid bug bounties. ### Source excerpt In this post, we'll cover what bug bounty hunting is, the difference between vulnerability disclosure programs and bug bounty programs, and seven tips to get you started. ## Top 3 security best practices for handling JWTs DevFeed: [Top 3 security best practices for handling JWTs]() Original publisher: [Read original article]() Author: Liran Tal Published: 2023-12-18T19:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [JSON Web Tokens](), [Security](), [Authorization](), [Authentication](), [Python](), [Bug Bounty](), [Web Development]() Tags: [acquisition](), [ai](), [application-security](), [blog](), [developer](), [python](), [security](), [security-best-practices](), [snyk](), [snyk-open-source](), [tokens](), [web-applications](), [web-development]() ### AI overview This article presents three security best practices for handling JSON Web Tokens (JWTs), with practical Python examples. It explains the risks of exposing JWTs, including user impersonation and unauthorized access, and discusses secure transmission and client-side storage. It also describes how Snyk can help identify and remediate application vulnerabilities. ### Source excerpt In this blog post, we will discuss the top three security best practices for handling JWTs. We will also provide practical examples using Python and show how Snyk can help you identify and remediate security vulnerabilities in your application. [Next page]()