Mohamed Yusuf

Bug Bounty Hunter | Finding Bugs

[Mohamed Yusuf @Edx103]

After 4 months, 28 rejected reports, countless sleepless nights, and moments I almost gave up…
Today, I finally got my first valid bug. One triaged report. One step closer to my dream.

Bug bounty is hard, but giving up is harder.
This is just the beginning. 🚀
#BugBounty

[Rock Pratap Singh (Rocksec)🇮🇳 @Rockpratapsingh]

Radhe Radhe 🙏
May also end with 4 digits 😄
Bounty announced within 4 hours — probably my fastest bounty of 2026 so far.
Multiple reports currently Triaged, and in Pending state.

Consistency beats luck. Keep hunting.

#BugBounty #BugBountyHunter #bugcrowd #rocksec #hacking

[i_0x0 @AyushSonekar4]

i received my 2nd bounty of $750

#bugbounty #hackerone

[DestroyerX @ide9x]

الحمدلله و الشكر لله وحده

Yay, I was awarded a $,000 bounty on @Hacker0x01! https://t.co/1FhwPFQuEN #TogetherWeHitHarder

my first 4-digit bounty ever. been waiting for this for months.

#BugBounty #Hacking #Cybersec

[Saurabh Tripathi @saurabhh_11]

I earned $1,000 for my submission on @bugcrowd. Same program and they again downgraded P2 to P3 without any solid reasoning.
#ItTakesACrowd #bughunting #bugbountytips

[Rahmat Qurishi @RahmatQurishi]

all easy bugs , just reading js files, copying endpoints, and throwing them into repeater😅

[Mohamed Yusuf @Edx103]

@Eyax0 @Bugcrowd Congrats

[Eyad @Eyax0]

My first payout $$$$ on @Bugcrowd 🖤

[Vishal Vishwakarma @rootxvishal]

🔥 Ultimate IDOR Testing Checklist 🔥

📌 https://t.co/NcOjwsBrre

IDOR is still one of the most impactful bugs in bug bounty. Many critical findings start by simply changing an ID in a request.

💡 This checklist covers:
✔️ ID & UUID manipulation
✔️ API & version bypasses
✔️ Multi-account testing
✔️ GraphQL & WebSocket
✔️ Race conditions & batch abuse
✔️ Mobile, gRPC & blind IDOR
If you want high-impact bugs, don’t skip this. 🚀

#bugbountytips #bugbounty #infosec #cybersec

[Lagan Parihar @lagan_parihar]

$600 bounty from a simple misconfiguration found during recon.
Exposed database credentials ,company's internal zoom meetings and some kt sessions.

#bugbounty #infosec

[Mohamed Yusuf @Edx103]

@wearehackerone Quit and join another program

[Mohamed Yusuf @Edx103]

@pent0ss @Bugcrowd Congrats bro keep hunting

[Mohamed Yusuf @Edx103]

@yoyomiski Ho to be using Ai on bug bounty ?

[Mohamed Yusuf @Edx103]

@Atomsmade @Bugcrowd Business logic errors

[Mohamed Yusuf @Edx103]

I earned $300 for my submission on @bugcrowd https://t.co/D1llRavquI{id: "mohamed_yuusuf"} #ItTakesACrowd

[Mohamed Yusuf @Edx103]

P3 😀 #bugbounty

[Mohamed Yusuf @Edx103]

@Bugcrowd why does your triage teams to triage my submissions sometimes take about a week? My report has been waiting for triage even though the program lists an expected triage time ?

[Mohamed Yusuf @Edx103]

How long does it usually take for the @Bugcrowd triage team to review a report? My submission has been in triage for about a week even though the program has an expected triage time. Is this normal?
#bugbounty

[Mohamed Yusuf @Edx103]

It has been 1 month since my report was triaged by the @Bugcrowd triage team, but @intercom has not provided any response or taken any action on the submitted report. Hi intercom internal security team @intercom Could you please check the status and provide an update?

[Mohamed Yusuf @Edx103]

@AkashHamal0x01 It's true

[Patrickbatman @hamidonsolo]

I made close to $10,000 from bug bounties this month. I'm 19. Still in engineering school.

Here's what I didn't show you.

I found a Critical RCE — Remote Code Execution via path traversal on a company's server. The kind of bug that pays $5,000-$20,000.

Duplicate. Someone found it 12 days before me.

$0.

Same work. Same skill. Same report. Wrong timing.

That's one of dozens. For every bounty I post, there are 15+ reports that got:

→ Duplicated
→ Marked informative
→ Ignored for months
→ Closed as "not applicable"
→ Lowballed after months of follow-ups

But you know what I do when that happens?

I wake up. No emotion. No hate. I open Burp Suite. Next target. Next report.

Because if I don't, someone else will. Every day I take off is a day someone else dupes me on the next find. So I show up. Even when I don't feel like it. Even when it hurts.

Bug bounty is not "find bug, get paid." It's find 50 bugs, fight for 6, get duped on some of your best work, get ghosted on others, and still show up the next morning.

The $10K months are real. But behind every mountain is a hundred steps nobody sees.

If you're starting out and getting duped and rejected — that IS the path. You're not doing it wrong. You're doing it.

Keep going.