mert

PotreX

[mert @MertPolatis]

I have to say that all these security vulnerabilities were identified thanks to Claude. The penetration testing workflow I recently developed is proving quite useful. Actually, all of these security vulnerabilities were identified within two days, but since the reporting and manual testing processes took longer, I submitted the full report within two weeks.

[mert @MertPolatis]

I reported 70 high/critical vulnerabilities to a self-hosted bug bounty program within two weeks. There are almost no duplicates.

So far, 12 reports have been rewarded, totaling €21,000.

I still have 55 reports that are triaged and pending. Most likely, the total rewards will exceed €100,000 within two weeks.

Sometimes, hunting outside the well-known bug bounty programs can really pay off.

I can’t reveal which program it is yet because I still have so many active reports. I’ll share it once all of my reports have been fixed.

It’s a pretty awesome program :)

@bugbounty

[mert @MertPolatis]

I earned €5,000 for the security vulnerability described below. Random X-Forwarded-For IP addresses can bypass the rate limit, and the 4-digit SMS OTP code can be completely brute-forced. "account takeover"

Don’t forget to add this to your list. Similar issues have been discovered at many companies. You’ll probably come across something similar one day.

POST /api/mobile/token/validate/ HTTP/2
Host: https://t.co/67MuncFZVn
X-Forwarded-For: 198.51.155.70
Content-Type: application/json
Content-Length: 57

{"mobile":"0000989115","token":"1234","device":"android"}

@bugbounty

[mert @MertPolatis]

@cjav_dev What I mean is, I haven't been able to use it for two weeks.

[mert @MertPolatis]

@cjav_dev Hi Dear CJ, I sent you the organization IDs for my two accounts via message. Could you please help me with this if you have a moment? This is causing me financial loss every day. That’s because all of my accounts have the Max subscription, and my two-week trial is about to expire, which is resulting in a loss.

[mert @MertPolatis]

@cjav_dev Dm'd thanks

[mert @MertPolatis]

@ljs2214 @easlanbas16 1 yıl oldu

[mert @MertPolatis]

@ljs2214 @easlanbas16 @ljs2214 Bendede aynı sorun var mesaj gönderebilirsen paslaşırız 10 dan fazla işitme testi yaptırdım birçok özel hastaneye gittim doktorların pek yapacağı birşey yok

[mert @MertPolatis]

@mdisec @claudeai yeni hesap açtıktan sonra pro,max planınızın olduğundan emin olun. eğer yoksa otomasyon otomatik olarak kyc doğruladıktan sonra "denied" olarak işaretliyor. daha önce çok kez başvurmuştum her zaman pro,max plan olan hesaplarım onaylandı ama olmayanlar onaylanmamıştı.

[mert @MertPolatis]

2 hafta önce 2 adet claude hesabımın cvpsi habersiz düşürülmüş https://t.co/WmqFQuj3SE üzerinde "ın review" olarak görünüyor. eğer yeni hesap açarsanız apply butonu görünüyor ve kyc doğrulaması yapabiliyorsunuz ancak cvpden çıkarılanlar için bu buton 2 haftadır yok haykırıyoruz ama duyanda yok :D

[mert @MertPolatis]

@0xMstar @PrettyRecon Since 2022, you’ve been advertising this product/service. Are you a partner of theirs, or are you developing it yourselves?

[mert @MertPolatis]

@cjav_dev Hi dear @cjav_dev If you have a moment, I'd really appreciate it if you could check my messages. Thank you!

[mert @MertPolatis]

I have been a Cyber Verification Program (CVP) approved user for quite some time, but I recently discovered that I had been removed from the CVP without any notification. This happened approximately two weeks ago, and it appears that I am not the only one affected — many other users seem to be experiencing the same issue.

Both of my accounts were removed from the CVP without any notice. At the moment, the status on https://t.co/WmqFQuj3SE shows “In Review”, and there has been no progress or update for quite some time.

What makes this even more problematic is that I am now being blocked by the cyber verification safeguards even when sending something as simple as “hello.” I have completely cleaned my CLAUDE.md and all of my memory files to rule out any possibility that previous instructions or context could be triggering the safeguards. After doing so, Claude responds normally to a simple “hello,” but as soon as I provide even a basic cybersecurity-related prompt, the Cyber Verification safeguard is immediately triggered.

I am currently using Claude Opus 4.6. Previously, I was using Opus 4.7 while my account was CVP-approved, and it worked extremely well for my legitimate cybersecurity workflow.

This situation has severely disrupted my workflow. I spent months building and refining my CLAUDE.md and memory files, running extensive tests, and carefully tuning them to ensure that no harmful or unauthorized activity would be performed. I have invested a significant amount of time into creating a safe and reliable workflow, and losing CVP access without any notification has made that workflow essentially unusable.

I understand that Anthropic has real-time cyber safeguards in place, and I fully support the goal of preventing harmful use. However, in this case, I believe something may have gone wrong with my CVP status, especially given that my previously approved access was removed without notice and my application is now stuck at “In Review.”

If someone from the CVP or support team could look into my account and clarify what happened, or restore my CVP access if this was an error, I would really appreciate it.

opus 4.6 Although it used to produce fewer cybersecurity-related errors, it has become completely broken now. There are no trigger .md files or memory involved, yet even a simple cybersecurity prompt immediately triggers Cyber Verification.

Best Regards
Thank You!

@ClaudeDevs @claudeai @cjav_dev

[mert @MertPolatis]

@fsimonsec When testing for a security vulnerability, you must be clear; the phrase "it's possible" is unacceptable—it must always be replaced with "I have done it."

[mert @MertPolatis]

@cjav_dev Thank You reply! I sent it to you via message.

[mert @MertPolatis]

@impost0r_ @ivanrouzanov Same problem 😡

[mert @MertPolatis]

@AlyedaTale @capulcu_simo İşe alındın…