Real findings. Real clients. Real results. Real bounties.

Disclosed reports by our researchers Ridwan Adebayo and Abang Obed, triaged and paid by the programs. Every card starts with a plain explanation, then the technical account.

What is a disclosure?

01

We find a security flaw in a live product.

02

We report it privately to the vendor, not the public.

03

The vendor fixes it, and many programs pay for the report.

Tesla OData Wildcards to Employee Directory
Bug BountyMar 31, 2026

Tesla

Tesla OData Wildcards to Employee Directory

In plain terms: A search feature on a supplier portal let an outsider page through Tesla's internal staff directory, phone numbers and all.

Read the story →

P2

Tesla Severity

$2,000

Bounty Paid

Supabase Auth Bypass to Admin
Bug BountyApr 26, 2026

Enterprise SaaS

Supabase Auth Bypass to Admin

In plain terms: Signing up with a partner email was enough to get a working session, and one form field let anyone claim to be an admin.

Read the story →

9.1

CVSS Score

$1,800

Bounty Paid

Luxury SSO Chain to Broken Access Control
Bug BountyApr 26, 2026

Luxury Brand

Luxury SSO Chain to Broken Access Control

In plain terms: A public settings file handed over the keys, and the login flow never checked who was actually signing in.

Read the story →

6.5

CVSS Score

x3

Paid Environments

Payment Replay to Free Compute Credits
Security AdvisoryJun 21, 2024

CodeSandbox

Payment Replay to Free Compute Credits

In plain terms: Replaying an old payment created new credits, like a receipt that works every time you show it.

Read the story →

High

Severity Triage

GHSA

Credited Reporter

Polyglot Upload to Stored Script Execution
Responsible DisclosureMay 4, 2026

Major Browser Vendor

Polyglot Upload to Stored Script Execution

In plain terms: One file could pass as a harmless archive and still run code when the browser opened it.

Read the story →

P3 S3

Severity Set

Kit

Reproduction Delivered

Share Flow Messaging Restriction Bypass
Responsible DisclosureAug 19, 2026

Global Social Platform

Share Flow Messaging Restriction Bypass

In plain terms: A private account blocked direct messages, but sharing a post quietly delivered one anyway.

Read the story →

Review

Preliminary Passed

Fixed

Behavior Observed

CTA Background

Know your risk. Strengthen what matters.

Tell us where you are, what you rely on, and what you need to protect. We will help you understand what to do next.

Talk to us