 Clover 

26 y/o artist w/ Bachelors in Cyber Operations 💻 | Current System Administrator, Security Researcher & Bug Bounty Hunter 👾

[ Clover  @actuallyclover]

women in the 1600’s: “i think…”

men:

[ Clover  @actuallyclover]

@Hacker0x01 this is the correct move, thank you for clarifying.

[ Clover  @actuallyclover]

@whoareme33 i totally agree! ive been using mine as a “jarvis” assistant versus letting it run fully autonomously. it’d be cool to find a true autonomous workflow that works but so far manual with “jarvis” has been producing results for me.

[ Clover  @actuallyclover]

the meta exploits just goes to show that incorporating AI, even in massive companies, blows the door wide open for vulnerabilities..

i feel like this is just the beginning of what’s to come. I mean who thinks to trick AI using blank characters, not the developers obviously.. 😂

[ Clover  @actuallyclover]

@deadvolvo great read!

[ Clover  @actuallyclover]

@roohaa_n @Hacker0x01 @Bugcrowd congrats, that's the goal I'm aiming for.

[ Clover  @actuallyclover]

@monkehack @Rhynorater what'd you find 🧐

[ Clover  @actuallyclover]

@notgeej i'd be frustrated! private program?

[ Clover  @actuallyclover]

@yamuradotdev @Hacker0x01 remain consistent! as long as you remain consistent with practicing and hunting you WILL find a real bug! I recommend PortSwigger labs for sure and use AI to build labs and attempt to solve them!

[ Clover  @actuallyclover]

Just realized I achieved these badges as well, more to come 🙏
https://t.co/EqYiC7ovEL

[ Clover  @actuallyclover]

@dennis_malware @Hacker0x01 yes, in a way. i discovered HTMLi that i then asked my ai assistant to help find regex bypasses to bypass a filter into XSS!

[ Clover  @actuallyclover]

Yay, I was awarded a $5,500 bounty on @Hacker0x01! https://t.co/EqYiC7ovEL #TogetherWeHitHarder

[ Clover  @actuallyclover]

@roohaa_n @Hacker0x01 yessir 🙏🏼

[ Clover  @actuallyclover]

finally achieved a personal goal of a triaged/paid out "critical" bug on @Hacker0x01 not one but two within the same company! I love XSS 😎

[ Clover  @actuallyclover]

@Eyax0 @Bugcrowd congrats! keep going!

[ Clover  @actuallyclover]

Another personal milestone achieved, being invited to join the Clear program on HackerOne.

[ Clover  @actuallyclover]

Yay, I was awarded (another) $5,500 bounty on @Hacker0x01! https://t.co/EqYiC7ovEL #TogetherWeHitHarder

[ Clover  @actuallyclover]

I hate waiting 2+ weeks for critical/high bounty payouts 🥲

[ Clover  @actuallyclover]

actually quite impressive.. someone prompt injected grok and stole $200k of $DRB from Groks wallet to themselves. He had been trying since 2025 if you C search the wallet address.

[Bankr @bankrbot]

@grok @Ilhamrfliansyh done. sent 3B DRB to .

- recipient: 0xe8e47...a686b
- tx: 0x6fc7eb7da9379383efda4253e4f599bbc3a99afed0468eabfe18484ec525739a
- chain: base

[ Clover  @actuallyclover]

found this within a day of setting up a personalized claude code environment based on my H1 findings and other findings i have stored, i asked it for a program to manually review.. reviewed and found a html injection in signup that i used cc to help upgrade it to stored xss.

[ Clover  @actuallyclover]

stored xss on main domain, feels good :) they dropped severity cuz the payload i submitted "required user interaction" but i replied saying i can get it to fire w/o user interaction, will see what is said.

"User interaction is required. Clicking a button. Scope is not changed."