How this blog works (and what I will not publish)
This is the public notebook of my bug bounty work. One rule: nothing goes live before the program allows it.
What you will find here
- Writeups of vulnerabilities with reproduction, impact and the lesson.
- Methodology and dead ends: most of the work is discarding.
- Tooling notes on recon, triage and reporting.
What you will not find here
- Live targets with client data.
- Payloads against systems that did not authorise testing.
- Unredacted hostnames for findings still open with a program.
Publication policy
| Status | What is public |
|---|---|
validated | Full technique, target redacted |
ready-to-submit | Full technique, target redacted |
candidate | Technique and what is still missing, target redacted |
disclosed | Everything, including the target |
How it is built
Static site generated from markdown: no database, no JavaScript, no tracking. Each entry in the Hall of Fame carries its real state — including the ones that never produced a bounty.