I am working on something fun with @KarimPwnz to address the challenge of repetitive security questionnaires: @BlueMagnetIO (bluemagnet.io).

I have been playing around with SvelteKit a lot recently. I wrote a short blog post on adding security headers to SvelteKit applications: edoverflow.com/2023/svelteki…. I might do a more long-form one on the security pitfalls of SvelteKit applications at some point.

There is a recent publication (12 Jan 2023) where the authors explored these factors and even ranked each factor's importance with a survey: arxiv.org/pdf/2301.04781.pdf. Learning and building a career are some of the other factors not mentioned in your tweet.

Great talk! I added a reference to the talk in my blog post: edoverflow.com/2022/reading-…. I will add a link to the YouTube video when @NahamSec uploads it. :)

And here are some photos from the trip. Thank you, @spaceraccoonsec, for being an excellent tour guide. :)

Thank you, @fbsecurity, for organising another fantastic event. I thoroughly enjoyed BountyCon and exploring Singapore. Team BBAC members (@xdavidhu, @_zulln, @ElSec_, @spaceraccoonsec, @rub003, @EdOverflow) managed to find valid vulnerabilities with @rub003 finishing #3 overall.

This looks like a fun chain by @fransrosen. If readers are interested in rapidly checking CSP hosts, I wrote a tool for grabbing them concurrently: github.com/EdOverflow/csp.

This brilliant passage by @fin1te in whitton.io/articles/from-res… resonates with me. Reviewing codebases in the open-source space has allowed me to better visualise the underpinning of an application and recognise keywords.

I had an amazing time collaborating with @xdavidhu, @ElSec_, @rub003, and @_zulln during @fbsecurity's BountyConEdu live hacking event as Team BBAC. So stoked on the #1 finish. Thank you @fbsecurity for hosting the wonderful event. :)

After 5 years of work, security.txt is officially an RFC. I am pleased to announce RFC 9116: rfc-editor.org/rfc/rfc9116. I would like to use this opportunity to thank those who made this possible. Thank you. ❤️

When mistakes have been discovered in an RFC, the document will include an "Errata exist" link. Errata in RFCs may result in developers making mistakes in their implementations. It is worth reviewing the errata for issues relating to security. 🧵 [5/5]

To simplify the reading process of outdated RFCs, the IETF have a dedicated tool called Rfcdiff Tool (tools.ietf.org/tools/rfcdiff…) which allows you to diff RFCs. 🧵 [4/5]

Review outdated RFC specifications. You can tell an RFC is outdated because the document's front matter contains an "Obsoleted by:" link. 🧵 [3/5]

RFCs must include a "Security Considerations" section that covers the security practices readers must consider when implementing the RFC. As a bug bounty hunter, consider reviewing this section to understand the security considerations the authors of the RFC made. 🧵 [2/5]

You shared topics you would like to see bug bounty hunters blog about. Here is an opportunity to be featured in my next blog post and have your bug bounty questions answered. ➡️ Send me a DM or email with your question, and I will respond to the best questions in a blog post.

Have you watched youtube.com/watch?v=Gv1nK6Wj… by @TomNomNom by any chance?