Pappa Pug

Security Researcher Friend, Advocate & Community Activator

Host of The Island 🌺 🏝️
🕹️ also working on web3 auditing indie game!

prev @immunefi

[Pappa Pug @PappaPug]

The triage bottleneck

nobody wants to talk about it loudly, but it's killing the SR experience.

Report volumes have been absolutely sending since 2023, but the pool of qualified triagers keep shrinking relative to demand.

And I've seen the backlog numbers; they aren't pretty.

Add on AI submissions, AI tools, and more efficient SRs, the signal-to-noise ratio is collapsing in real time. What else can be done?

*image is for illustration purpose

[angel @angeldot_]

> El CEO de OpenAI admite que la IA no causará el apocalipsis de empleo que predijo

> Uber no encuentra un retorno que justifique sustituir humanos por IA

> Starbucks elimina la IA de su sistema por fallos constantes

> Microsoft retira Claude Code a sus ingenieros por no ver mejora en costes

NATURE IS HEALING

[Matt Popovich @mpopv]

the top right corner of vscode is starting to resemble an iq test

[kepano @kepano]

really enjoyed collaborating with @AdamWhitcroft on this one!

[bartek.eth @bkiepuszewski]

The original MakerDAO code written in "daiwanese" is still one of the most underappreciated SE feasts in Web3. It's the opposite of current code slop with hundreds of unnecessary libraries and object hierarchies. Complicated code = more surface to exploit

Study daiwanese. Minimize your code. Learn FV. The future is opposite to current slop practices

[Pappa Pug @PappaPug]

@adrianhetman Great snaps as always Adrian!!

[Pappa Pug @PappaPug]

SR Life Simulator is still in development... I just had to find a way to pay the bills in the meantime.

My dream of becoming an indie dev is still in progress, but at least I'll be able to take care of my family for now.

[Pappa Pug @PappaPug]

LIFE UPDATE!

I've been praying and looking for the right opportunity these last 6 months...

And almost miraculously it appeared just two days ago, when I was invited to join a walk-in interview.

It was a two-stage interview, and there were loads of people overflowing the lobby of the office.

Out of the hundreds of nervous people there, I somehow felt strangely calm. And before long my name was called.

Instead of going through the stages, I was brought straight to the final interview room to face the hiring manager.

And praise God, I was accepted within that same interview. I was able to go home immediately. "See you Monday", they said.

My name wasn't even on the list at first... I didn't know anything about the position or project when I walked in.

But when I heard the hiring manager speak I knew it was the right project for me. Reconnecting with my hospitality roots with white glove service.

I'm sure these next three months will be extremely interesting.

Thank you Lord Jesus. 🕊️ Hallelujah.

[brainiac @shealtielanzz]

Notice how hacks increased as contests died off.
You can say AI but there’s a bunch of Whitehats involved in these hacks.
You onboard lots of them then you take their jobs away.

[Adrian ⛩️ Hetman 🐺 | 📓+🖋️+☕️ @adrianhetman]

Welcome to web3 security

[Adrian ⛩️ Hetman 🐺 | 📓+🖋️+☕️ @adrianhetman]

There's a legitimate frustration buried in that take, but it rests on a misread of why BBP platforms exist.

A bug bounty program is not a contact form. It's a contract. The platform is what makes that contract enforceable on both sides. Projects get filtered signal and predictable triage. Researchers get clear rules, payout SLAs, dispute resolution, and a record of work that compounds into reputation. Other responsible disclosure routes exist for the urgent stuff, SEAL 911 being the obvious one, but the premise sits in the same place. Structure exists so serious work can get through.

The "just send details over email" model sounds lightweight until you sit on the receiving side. I triaged thousands of reports running MTS at Immunefi. The cost asymmetry is brutal. A researcher can write a scary-sounding critical report in 15 minutes. Invalidating it takes a senior engineer 1 to 2 hours on average. Sometimes more. Small and medium teams don't have that headcount. The big ones already outsource it.

With hacks happening almost daily, projects should be taking security more seriously, and many are. But it remains a genuinely hard problem. BBPs catch what a researcher can find externally on the same surface as an attacker. They don't and can't cover everything. A lot of recent damage has been infrastructure failure rather than code bugs, and that surface is hard to fold into a BBP without monthly or quarterly pentests on top.

The platform requirement does one more thing that gets missed in these threads. It self-selects for researchers willing to engage with the process. That friction is a feature, not a bug. If signing up for a platform a project explicitly named in their program rules is the dealbreaker, the report was probably not going to clear the bar anyway. Serious researchers maintain accounts on the major platforms because that's where the work is.

The AI era raises the floor of all of this. Anyone can prompt a model to produce a coherent-looking critical report with fabricated impact and confident language. Valid work gets buried under that slop, which is precisely what feeds the scepticism. Structured intake, enforceable rules, and reputation on a platform are the only things that hold up at scale. At least for now.

So the real question is what intake model actually gets bugs fixed at scale, not whether platforms add friction. The honest answer is managed triage on a platform, with SEAL 911 and similar channels for the cases that can't wait. Teams that skip this either drown in noise or quietly hire someone to handle it.

[0K @ZeroK_____]

I never realized how much of this space revolves around marketing companies and AI agents until I learned more about them. Some companies and most “AI agent” guys are just doing pure marketing nonsense, nothing more and nothing less. Meanwhile, blackhats keep showing us what real work looks like by hacking a new project almost every day. So ignore all this nonsense, focus on securing people’s money, improving your skills, and earning good rewards for yourself.

[Pappa Pug @PappaPug]

@shealtielanzz @HackenProof Yoo Mr #1!!

[Dacian @DevDacian]

Future of web3sec: Arms Race - Defensive AIs vs Offensive AIs, with teams of elite humans continually improving them.

Protocols that aren't monthly scanning their existing code using continually improving Defensive AIs will fall behind the curve & more likely to be exploited.

[ℏεsam @Hesamation]

tech industry is optimizing itself to death.

[Pappa Pug @PappaPug]

Maybe I'll work full time on developing Obsidian plug-ins 🐾

[kepano @kepano]

We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come.

I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask!

This has been an incredibly challenging project for a number of reasons. We're only seven people but we have thousands of plugin developers and millions of users. There are many competing priorities to balance.

We wanted to make sure the new system would be easy to adopt, backwards compatible, and not completely break people's workflows, while still being a major improvement over the old approach, and allow us to gradually continue enhancing security and discoverability of plugins.

Consider it a work in progress. We're listening to everyone's ideas and gripes, and will keep iterating :)

[Pappa Pug @PappaPug]

@ZeroK_____ Amazing guy. I'm so sorry to hear about your father. But his life and determination is magnified in you and your good deeds which are many.

And your journey is only going to get more interesting, more and more and more.

Keep going my friend. Such a joy to witness your path.

[Pappa Pug @PappaPug]

The ability to enjoy the journey is 100% the reason to continue after facing the worst.

No amount of grit is worth simply the love of doing.

[0K @ZeroK_____]

Near the end of 2024, around November to December my entire life turned upside down. I never expected what happened next, and for more than a year I planned to never talk about it. But I think I need to, because it affected me deeply, both in life and as a hunter.

2024 was the best year of my life. It was the year I finally found myself. I discovered value in what I do. Being a security researcher and hunter in Web3 stopped feeling like “just a job”, it became something much bigger to me.

People started recognizing my work. I met incredible researchers and hunters I genuinely respect and look up to. I built amazing friendships and connections. The feeling was indescribable. I was truly happy, and I enjoyed every single moment of it.

At the beginning of 2024, I set a goal for myself: make $100k.

People around me in real life laughed at that goal. They told me it was impossible. Some even said I should stop wasting time and look for a normal job that pays $150/month at mos.

“Being rich is not for us,” they said.

To them, $100k was something unreachable.

So I distanced myself from those people, even though some were my friends. Not because they were bad people, but because we had completely different mindsets and goals. I had to choose myself.

That same year, I seriously started hunting on @immunefi. I had a bad experience on another platform before, so I decided to give Immunefi a chance. I knew nobody there. No hunters, no team members.

But the process felt professional from day one.

Then I got my first $2k bounty. I was insanely happy 😂

I kept hunting, joined the Discord, and met amazing people from the Immunefi team and the community. I learned a lot, worked on many BBPs, and eventually Immunefi introduced Boosts (now contests) and Attackathons.

That’s where my life completely changed.

Then the Fuel Attackathon happened.

I saw the $1M reward pool and a completely new language I had never touched before, and I told myself:

“This is my chance.”

I pushed hard. During that time I also landed another bounty. Eventually I made around $15k from bounties and around $86k from Fuel.

I should’ve gotten second place, but some things happened and I secured fifth instead.

And here’s the strange part…

I felt nothing.

No happiness. No excitement. No celebration.

Just emptiness.

I felt confused, mentally exhausted, almost like something inside me had shut down. I kept asking myself:

“Why aren’t you happy? You achieved your goal. You proved everyone wrong. Why do you feel nothing?”

Before I could answer that question, the second worst thing happened.

My father had his first brain stroke.

We rushed him to the hospital trying to save him. Then another stroke happened. Then another. I spent countless nights in hospitals, mentally destroyed. I became deeply depressed in a way I had never experienced before.

At one point, I seriously thought about quitting Web3 and bug hunting entirely.

I remember opening my phone late at night planning to delete everything I built.

Then somehow I saw one of @lonelysloth_sec’s posts talking about patience, not giving up, and how hard this journey is. I don’t even remember the exact words anymore, but that post stopped me from making a huge mistake.

Because people like him, @WhiteHatMage, and others became role models to me in this space.

So I decided to wait instead of quitting.

Meanwhile, my father’s condition kept getting worse. Eventually doctors told us there was nothing more they could do. We just had to fulfill his wishes and stay beside him until the end.

And when he passed away in 2025…

I felt nothing again.

No tears. No breakdown. Just emptiness.

The same emptiness I felt after reaching my biggest goal.

That completely broke my understanding of myself.

I forgot who zeroK really was.

Months later, something incredible happened: @0xjonah1 messaged me saying I got accepted into All Stars.

That gave me hope again.

But even then, something still felt missing for almost a year and a half. I couldn’t figure it out. I tried convincing myself I was overthinking.

year passed, Doing my best every day just to make sure I deserve my place at Immunefi and among the All Stars.

Then, a few weeks ago, I got a clue about what was missing when I DM’d @WhiteHatMage asking for some advice related to working as hunter. While reading his messages, I felt like my brain was trying to reconnect with something I had lost for almost a year and a half...

something that shaped who zeroK is both in real life and in the Web3 space. But at the time, I still couldn’t fully understand it, and I kept telling myself, “Maybe I’m just overthinking it.”

Then Firedancer happened.

I participated a bit, got overwhelmed, submitted only one bug, and honestly felt lost again.

Then Infosec team reminded me that I should trust myself, that being part of All Stars already proved I belonged here.

And suddenly it clicked.

I finally realized what I had lost.

It wasn’t motivation.
It wasn’t discipline.
It wasn’t skill.

It was my ability to enjoy the journey.

That was always the best part of me.

Enjoying the process.
Smiling during hard times.
Helping people.
Learning.
Connecting with others.
Being curious.
Building something meaningful.

I realized I never truly wanted $100k for the money itself.

I wanted proof that I had value.

Proof that I belonged somewhere.
Proof that I could become the person I always wanted to be.

And once I reached it, I didn’t know what came next.

Now I finally understand it.

Money matters for survival, yes. But chasing money alone made me miserable for an entire year.

Now I’m chasing something different:
my dreams,
my growth,
my journey,
the people I meet,
the things I build,
the impact I leave behind.

That’s what actually makes me happy.

Being recognized for meaningful work.
Protecting people.
Saving users from exploits.
Being good at what I do.
Being kind while doing it.

I’m glad I found myself again.

And I’m deeply grateful to the people below who helped me rediscover that part of me, even without knowing what I was going through:

@lonelysloth_sec
@DecentralDisco
@PappaPug
@WhiteHatMage
@minato7namikazi
@0xMackenzieM
@0xjonah1
@MartinMarchev
@thisisgrey, who built my profile picture, the interview we did helped me remember part of who I really was.

And many other amazing people too that I might not remember while writing this post.

The only reasons I posted this are:

1. I want people to know that the joy of a goal you set for yourself ($100k, $500k, $1M, $10M, building something, buying something, achieving something) is not in the moment you finally reach it, it’s in the journey and the path you go through. 95% of the joy is in the process, not the destination.

2. I just wanted to talk a little bit lol.

[kepano @kepano]

@_thinking_reed you mean like this
https://t.co/GdU5TICD0h

[Pappa Pug @PappaPug]

Thinking of somebody... 🤺

[Pappa Pug @PappaPug]

Came up with a template to play security researcher bingo!

(the first 15 are mine, claude did the rest)

[Ethan Mollick @emollick]

So Mythos was, indeed, not marketing hype.

Remember this is a general purpose model that just happens to be good at finding exploits because good models are good at lots of things. Expect similar from OpenAI & Google. And from open models in 8 months. https://t.co/KbhalQYX8R