yuribm

Turning walls into doors with code. Developer, open-source contributor, and digital preservation enthusiast. Just shipping things.

[Philo Groves @PhiloGroves]

OpenAI should rename the highest cyber tier to Max TAC

[yuribm @Yurikk28]

@Zaddyzaddy @BugBunny_ai I would love to try.

[yuribm @Yurikk28]

Bug bounty triage is wild: report a real staging bug, retest days later, behavior changed.

Lesson: record video at submission; truth expires fast. @0xPira

[yuribm @Yurikk28]

@LustroAE @claudeai @lucas_montano @bridgemindai @ClaudeDevs https://t.co/Zqn0LDPFGt

[yuribm @Yurikk28]

Opus 4.8 + Ultra Code mode.

48 hours later: 3.3B tokens burned. Almost $1,000 gone.

I’ve been using the plan for 8 months and had never managed to hit anything like this.

I barely even used it properly on day two.

It was beautiful to watch, but painfully expensive.

[bugcrowd @Bugcrowd]

Hacking tip 😎

Don't assume that something is secure just because the feature exists.

We saw a bug recently where an application had custom auth. The user entered their password, if it was correct they had to enter a 6 digit code that was sent to their email address. The endpoint had throttling enabled.

Most hackers would stop there. This one didn't! They worked out that the password step could be skipped completely, and then they worked out that the throttling on the 2FA endpoint was throttled by IP.

They found a full ATO on any account by rotating their IP address on every request and simply brute forcing the 6 digit code.

If you're a hacker, don't assume anything!

[yuribm @Yurikk28]

ok, isso realmente é impressioannte, 95 dolares e so usou 4 porcento do uso semanal

[Alex Birsan @alxbrsn]

hey @Bugcrowd can we please make this checkbox do something thanks

[yuribm @Yurikk28]

um novo submit para o auth0, vamos ver oq vai dar...

[ClaudeDevs @ClaudeDevs]

/radio

[yuribm @Yurikk28]

@MrBeast Let's try

[yuribm @Yurikk28]

Encontrei um bug critical q deu duplicated por conta de 4 horas de diferença KKKKK

[yuribm @Yurikk28]

Valeu demais pelo retorno, equipe @arkanisgg / @ostracontent!

Feliz em saber que parte dos pontos já foi implementada. Sempre que eu encontrar algo relevante em análise de segurança, vou ficar à disposição para reportar com e ajudar no que puder.

Tamo junto 🤝 #Arkanis

[yuribm @Yurikk28]

Of the 4 bugs I found, 2 were duplicate medium-level bugs and 1 was a duplicate high-level bug; the other is still marked as critical and will probably go to triage, do you think I'll get my first bounty?

[pira;) @0xPira]

BUG BOUNTY é um jogo de gato e rato MUITO engraçado

> eh o hacker tentando justificar que o bagulho tem o maior impacto possivel

> e o triager tentando provar que essa merda eh inutil

FACILMENTE um tribunal de MINÚSCULAS causas

[vx-underground @vxunderground]

I was reading this and I double checked my blood pressure to make sure I wasn't having a stroke or hallucinating from a brain aneurysm

[yuribm @Yurikk28]

@ireteeh I'm participating in bug bounty programs, so support would be greatly appreciated

[pira;) @0xPira]

Quem utiliza calculadora pra fazer conta não é engenheiro de verdade

[obscaries ❘ AppSec @obscaries]

Whether you're into web2 or web3, there’s opportunity everywhere.

Keep grinding ⚔️