I’m Hossam Hamada, a security researcher and bug bounty hunter. During an authorized security assessment, I discovered an interesting OTP…

While testing a web application for broken access control issues, I came across an interesting case where a workspace that was supposed to…

The pursuit of lucrative vulnerabilities within Intel systems has unexpectedly ceased to be financially rewarding. In mid-September, the corporation replaced its paid Bug Bounty initiative with a …

First of all, hello everyone. I am a researcher with little experience, but I often find myself daydreaming about exploits and exploit…

How a Predictable Activity ID Bypassed an Unguessable Invite Link and Earned Me a $1,000 Bounty

How Changing a POST Request to GET Exposed Users’ Privacy Requests

I discovered that a CRM platform’s “Custom Code Functions” feature (an Enterprise-tier automation capability) allows any authenticated user…

Introduction

Hey there,

Google suspend son bug bounty open source submergé par l’IA Face à un déluge de faux signalements générés par l’IA, Google a gelé les soumissions de failles visant ses logiciels open …

GitLab Patches a Maximum-Severity Flaw GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user in…

How a missing RBAC policy check exposed security actions and resources to low-privileged users.

TL;DR: In the admin panel of a Ruby on Rails e-commerce platform, the alert component renders its message with .html_safe — i.e. without…

TL;DR: A Ruby on Rails e-commerce platform enforces a promotion’s redemption limit (e.g. a single-use coupon) by counting the completed…

The open-source project cURL announced a significant restructuring of its triage workflow. Starting October 26, 2026, researchers must submit low and medium severity vulnerability reports directly…

Discovery got industrialized. Remediation didn’t.

“وَمَا تَوْفِيقِي إِلَّا بِاللَّهِ ۚ عَلَيْهِ تَوَكَّلْتُ وَإِلَيْهِ أُنِيبُ”

“وَمَا تَوْفِيقِي إِلَّا بِاللَّهِ ۚ عَلَيْهِ تَوَكَّلْتُ وَإِلَيْهِ أُنِيبُ”

In the previous article, we touched upon the basics of certificates, mTLS, x509 standard for certificates, along with public and private…