3 ms·
> when you could just push a change to prod instead. I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty an
by hansvm 2y ago
> when you could just push a change to prod instead.
I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty and the developers' bias against inaction.
- azeirah 2y ago100%, hacking is as much technical prowess as it is social engineering.
- Thorrez 2y agoHow about this one: https://hackerone.com/reports/745324 https://hackerone.com/reports/745324 It's a $20k bounty for simply taking a cookie that a HackerOne employee accidentally pasted when responding to a different vuln report on HackerOne.