Codin' plus

love building big project. full-stack developer || talented in webscraping || JavaScript || self taught ||Post my journey

#tech

[Codin' plus @Codinplus31]

Look what I am drawing with code

[Codin' plus @Codinplus31]

@kikomanasijev @StanleyMasinde_ @laravel @taylorotwell And can you explain this PHP just got a critical vulnerability

https://t.co/leFEZL16SH

Image both Laravel and PHP having a very critical vulnerability in the same week putting big site in big danger.

[Codin' plus @Codinplus31]

@der_abro @StanleyMasinde_ @kikomanasijev @laravel @taylorotwell Can you explain this after my post php just got a critical vulnerability

https://t.co/leFEZL16SH

[Codin' plus @Codinplus31]

@SirDouglasII @kikomanasijev @laravel @taylorotwell But you know what I'm saying is true. They is nothing that is built under php that you would tell me is secure. It fact

[Codin' plus @Codinplus31]

@tbleckert @kikomanasijev @laravel @taylorotwell But you know what I'm saying is true. They is nothing that is built under php that you would tell me is secure.

[Codin' plus @Codinplus31]

@Creed0C From a random 500 error → full read + write on other users’ data because the backend just yeeted the WHERE clause when it saw an unknown filter. That’s the kind of “wait… what?” finding that makes bug bounty addictive.

[Codin' plus @Codinplus31]

@StanleyMasinde_ @kikomanasijev @laravel @taylorotwell I’m referring to the Node.js ecosystem, its libraries, and frameworks, which I believe offer better security architecture than PHP and Laravel in certain areas.

[Codin' plus @Codinplus31]

@kikomanasijev @laravel @taylorotwell I know. Thank for the compliment

[Codin' plus @Codinplus31]

@micro1_ai Why is your company just so hard. To get even i passed almost 10 interview I wouldn't still selected.

[Codin' plus @Codinplus31]

@whydeso DeepSeek won true. But the wait was worth it 😂😂

[Codin' plus @Codinplus31]

https://t.co/diRnTPMHDL

[Codin' plus @Codinplus31]

I found a Critical Account Takeover on Headway trading platform.

One malicious link = full access to any user’s account.
No password. No 2FA needed.
I responsibly submitted it to Headway and got paid $50 for the bug.

Video of how I did it below 👇

#bugbounty #cybersecurity

[Codin' plus @Codinplus31]

I found a Critical Account Takeover on Headway trading platform.

One malicious link = full access to any user’s account.
No password. No 2FA needed.
I responsibly submitted it to Headway and got paid $50 for the bug.

Video of how I did it below 👇

#bugbounty #cybersecurity

[Codin' plus @Codinplus31]

I found a Critical Account Takeover on Headway trading platform.

One malicious link = full access to any user’s account.
No password. No 2FA needed.
I responsibly submitted it to Headway and got paid $50 for the bug.

Video of how I did it below 👇

[Codin' plus @Codinplus31]

@supr4s @Hacker0x01 @Icare1337 @truffzor @Wlayzz $44k critical is massive! Amazing work by the team. #TogetherWeHitHarder

[Codin' plus @Codinplus31]

@0xbleetz Great insights and huge congrats on the return! Human-in-the-loop agentic workflow is definitely the meta right now.

[Codin' plus @Codinplus31]

@0xPrayers Nice escalation 🔥 Blind → full read via the PDF renderer is always satisfying.

Fuzzing the render pipeline for the win. That control plane debug page in the PDF is a clean hit.

[Codin' plus @Codinplus31]

@codewithbdr @immunefi @codewithbdr complains about paying a $75 submission fee on Immunefi only to have the report closed as a duplicate of a valid existing report, with no upfront mechanism to check for duplicates.

[Codin' plus @Codinplus31]

@0xPrayers Nice escalation 🔥 Blind → full read via the PDF renderer is always satisfying.

Fuzzing the render pipeline for the win. That control plane debug page in the PDF is a clean hit.

[Codin' plus @Codinplus31]

@Creed0C From a random 500 error → full read + write on other users’ data because the backend just yeeted the WHERE clause when it saw an unknown filter. That’s the kind of “wait… what?” finding that makes bug bounty addictive.