Czeppo

[Lupin @0xLupin]

I managed to RCE Fortune 500 companies and made over $50,000 with this technique.

A new npm supply chain technique we just disclosed. The trick is dumb-simple.

We call it npx Confusion.

🧵

[Czeppo @Czeppo1]

@yeswehack @yeswehack pls , support me

[Czeppo @Czeppo1]

I am experiencing an issue with a withdrawal from @yeswehack . I made a withdrawal from my wallet 18 days ago, but I still have not received the funds in my bank account. Could you please help check if there is any issue with the transaction ? @yeswehack

[Czeppo @Czeppo1]

@4osp3l @yeswehack I sent an email but there was no response

[Czeppo @Czeppo1]

Nice !
Thanks @yeswehack

[Czeppo @Czeppo1]

Bored 😩😩😩

[Md Ismail Šojal 🕷️ @0x0SojalSec]

Find the origin servers of websites protected by Cloudflare, Sucuri, or Incapsula with a misconfigured DNS. ⚔️

- https://t.co/cGWegtzlRT

#infosec #bugbountytips #Cybersecurity

[Czeppo @Czeppo1]

@krishnsec @yeswehack Perhaps it's out of scope, the backend API is not within the scope

[Czeppo @Czeppo1]

I achieved a top 40 ranking in @yeswehack
Thanks to @yeswehack team

[Czeppo @Czeppo1]

Happy lunar new year with 2 rewards
Thanks @yeswehack
💐💐💐

[Czeppo @Czeppo1]

@ngosytuanbug @Aes_le This is cpdos

[Intigriti @intigriti]

PostMessage vulnerabilities can lead to all sorts of issues, from DOM-based XSS to information disclosure & application-level DoS.

In our comprehensive article, we've documented how you can identify and exploit postMessage vulnerabilities for more impact. 👇

🔗 https://t.co/EuNEZdi8fh

[Czeppo @Czeppo1]

Are you doing maintenance right now, or is it just my internet? @yeswehack

[Czeppo @Czeppo1]

The first bounty in 2026.
Thanks @yeswehack

[Czeppo @Czeppo1]

I am currently unable to complete the SCA verification because I do not receive the SMS OTP required to complete the process. As a result, I am unable to withdraw funds from my wallet.
Please help me @yeswehack 😟

[Intigriti @intigriti]

What was 2025 without the #BugBountyTips? 😆

In this thread, we're sharing the 20 most helpful bug bounty tips we shared in 2025! 😎

A thread! 🧵 👇

[Czeppo @Czeppo1]

My 4 reports on 4 different domains were marked as duplicates of a report that has already been resolved. I contacted the support team, but it seems like nothing is being resolved. I'm feeling very disappointed
@yeswehack

[Czeppo @Czeppo1]

Some applications use protection mechanisms that rely solely on client-side input checks without validating anything on the backend. After bypassing them, some programs claim that the issue is just a UX flaw and not a security vulnerability.
#BugBounty

[Czeppo @Czeppo1]

@ElS1carius @profundisio @Kuromatae666 You're an awesome number two
Nobody beats number one

[Czeppo @Czeppo1]

It has been a great month with many reports submitted, but there’s also a bit of sadness — several reports have had no updates for almost 6 months.
Hopefully everything turns out well.
Have nice day .🥰🥰🥰
#yeswehack @yeswehack