X-3306

Archive

Bug bounty and disclosures

The honest version. Every entry shows the severity the program or the standard gave it, not the one I would like it to have. Names are withheld where the issue is still open or the owner did not agree to be named.

LEDGER

Five findings

years shown where known
RefFindingRecord / year
D-01
Business logic flaw: phone verification could be bypassed, allowing unlimited free-tier accounts.Major AI platform, . Reported through Bugcrowd.
Fixedconfirmed, fixed, classified P5.
D-02
API authentication bypass, CVSS 8.1 (High).BreachDirectory API, hosted through RapidAPI. Direct report, 90 day coordinated window.
Fixedvendor never replied. fixed weeks later. write-up coming.
D-03
Cross-site scripting in Tuxdoc's login and registration forms.A working script injection issue.
2023the page no longer exists
D-04
SQL injection that could expose the full database of a hotel in Thailand. My first real vulnerability findingIdentified with sqlmap: the hotel is not named: Has been reported
2021/2022database exposure, first finding
D-05
API rate-limit bypass enabling access to premium features.Server-side checks could be bypassed. CVSS 7.5 (High).
2024access-control flaw
RULERS

How big, really

two scales
Plate C: severity as classified
Bugcrowd priorityP5P4P3P2P1lowesthighestD-01: P5. low, and listed anywayCVSS base score012345678910lowmediumhighcriticalD-02: 8.1, highD-05: 7.5, highD-03 XSS and D-04 SQL injection: no rating shown

A P5 is the lowest rung. I list it anyway, because a fix is a fix, and because the process taught me more than the score did.

CLOCK

One finding, 90 days

D-02
Plate D: the coordinated windowapproximate
AugSepOctJul 19 to 20: reportedsilencefixed some weeks later, date unknownOct 15: checked, fixedOct 18: 90 days up

The hatched stretch is a range, not a date: I only know it was fixed some weeks after the report. I will not write it up in detail before the window has run out.

RULES

How I handle a finding