The Claude Code Bug Bounty Run · Part 2 of 2 — Speed pays. Unsupervised write access bites back.

During one of my recent penetration testing engagements, I discovered an IDOR vulnerability with a surprisingly simple test — replacing a…

Introduction

Part 1 of the Bug Bounty Playbook series. 252 disclosed HackerOne reports analysed. Five recurring patterns. One testing framework you can…

Change one number in a web address, and suddenly you’re looking at someone else’s private data. No exploit code required.

BOLA/IDOR is the #1 API vulnerability on OWASP’s list. Most backend developers ship it constantly without knowing its name.

TL;DR SolarWinds fixed three critical SolarWinds Serv-U vulnerabilities on July 21, 2026. They allow privilege escalation and remote code execution on the file transfer server. SolarWinds rates ea…

TL;DR SolarWinds fixed three critical SolarWinds Serv-U vulnerabilities on July 21, 2026. They allow privilege escalation and remote code execution on the file transfer server. SolarWinds rates ea…

Neighbour lab is a beginner-friendly CTF provides a practical introduction to the IDOR (Insecure Direct Object Reference) vulnerability.

👻 The Ghost Subscriber: How I Haunted Hidan’s Premium Tiers An IDOR vulnerability in subscription APIs, a $200 bounty, and the 7-day ghost that proved privacy matters everywhere By …