Cybersecurity in one word ? For You 👇

GitLab security team waking up every few weeks: “yeah… another critical one.” CVE-2026-85706 is CVSS 10.0. Unauthenticated path traversal → arbitrary file read via the repository commits API. Self-hosted GitLab admins: please patch your shit. 💀

updated my jwt testing checklist as per 2026

ai is quietly breaking bug bounty economics. it made finding potential bugs almost free. but proving them is still expensive. a researcher runs an agent for hours. comes back with 20 findings. maybe 3 are real. the rest are duplicates. noise. no impact. someone still has to read every single one. discovery is becoming abundant. human attention is becoming scarce. that flips the economics of bug bounty. we used to compete on finding more bugs. now the edge is who produces the most signal. the best hunter won't be who runs the most agents. it's who explores 100 possibilities and finds the 2 worth reporting. when everyone has an agent, finding a bug stops being impressive. proving it's real, exploitable, and different becomes rare. if platforms don't fix triage, ai makes it worse for everyone. more submissions isn't more security. more signal is.

JWT testing gets tedious fast. Decode → edit → re-sign → repeat. Hakluke’s ( @hakluke ) toolkit makes it much faster. Paste a token and you can quickly test: - alg:none + case variants - Algorithm confusion - kid injection - Weak JWT secrets - Claim injection - Tampered tokens without re-signing The last one is my favorite. Disable auto re-sign → modify the token → send it. If the server accepts the tampered JWT without verifying the signature, you’ve got a finding. hakluke.com/jwt-hacking

The researcher was literally just ordering food. 🍔 At checkout, Grubhub asked which saved card should be charged. The researcher intercepted the request and noticed a parameter: credit_card_id Then came the thought: “What if I replace this with someone else’s?” 🤔 And it worked. The order went through using a stranger’s saved card. 💳 No card number. No phishing. No social engineering. Just broken authorization. And the potential impact was huge - Yelp disclosed that the flaw could have affected more than 1.5 million saved cards. 😳 This is the part of bug bounty I love. A normal person is ordering food. A bug hunter is ordering food while thinking: “Why is the server trusting this ID?” “What happens if I change it?” “What if this belongs to another user?” “What if I replay this request?” “What if the frontend blocks me, but the API doesn't?” That's the mindset. 🧠 You don't always need a complicated target, a 50-step exploit chain, or some crazy payload. Sometimes you're just doing something completely normal... and your brain refuses to accept the normal behavior. “What if I change this?” That question can turn a normal food order into a critical IDOR. 🚨 I found this while reading through critical IDOR reports on HackerOne, and it reminded me why I enjoy bug bounty so much. The best hunters aren't only testing applications. They're constantly challenging them. What if this belongs to someone else? What if I remove this? What if I change that? What if I shouldn't be able to do this? That mindset is everywhere. While ordering food. 🍔 While booking a hotel. 🏨 While changing an account setting. ⚙️ While using an API. 🔌 You never really stop thinking like a hacker. That's the bug bounty mindset. 🧠

How to think about authentication bypass before you test it. 82 disclosed reports, 8 parts, one framework.

I analysed 313 disclosed SSRF reports from HackerOne. 5 patterns repeat in almost every report. Two different chains lead to full RCE. I turned it into a testing framework you can run on every endpoint. Full breakdown on Medium: medium.com/@Aacle/the-bug-bo…

1/ Everyone knows HackTricks and PortSwigger. These are the resources that actually find bugs. Less hyped, higher yield. A short list I keep going back to. 🧵

Everyone is using Claude Code in their bug hunting. Almost nobody is using it well. 10 habits that separate "I tried AI" from "AI found bugs I'd have missed." Thread 🧵

Never used Claude Code in your bug bounty? You're leaving the boring half of your own workflow on the table. Step one isn't "find bugs." It's: export your HackerOne reports, feed them to Claude, & tell it to build skills Now it hunts like you, not like a generic pentester.

Everyone knows HackerOne Hacktivity. Nobody knows this repo: reddelexc/hackerone-reports (6.4k stars). Bug types Hacktivity doesn't: Business Logic, REST API, GraphQL, Web Cache, MFA, Auth Bypass, Mobile. reddelexc.github.io/hackeron… Bookmark before it disappears.