Bassem Sadaqah

[Ehsan @Ehsan1579]

I think the top bug hunters should be rewarded by the bug bounty platforms with DATA.

I want to know which projects are actually worth my time to audit, not waste hours on trial and error.

Give us a transparent list of projects that actually care about security. It’d save a ton of time and lead to way more valuable findings, a win for everyone.

Here are some parameters for example:

Actual Average triage response time
Average payout time
Average severity accepted
Percentage of duplicates vs. valid reports
Number of resolved vs. open reports
Last bounty paid / last report date
Median payout per valid report
Max payout per vulnerability type
Historical bounty trend
% of reports marked “Informative”

MOST IMPORTANT OF ALL:

Dedicated security team presence which should be rated by the security researchers that were paid at the end for that program.

I would gladly pay out of my pocket or percentage of all my findings to get this data.

It would make a huge difference at least for me.

[Bassem Sadaqah @bassemsadaqah]

@0xacb Thanks for sharing 🙏

[André Baptista @0xacb]

Exploiting slash/backslash mismatch to trigger cache poisoning.

This one-liner bug by @bassemsadaqah led to a CDN-wide DoS on Shopify and is a great example of how simple tricks can lead to impactful issues in mature organizations.

Full report here 👇
https://t.co/X4QXsX2VNF

[Bassem Sadaqah @bassemsadaqah]

@0xavvesome @disclosedh1 Thanks

[H1 Disclosed - Public Disclosures @h1Disclosed]

⚡ DoS Vulnerability via Cache Poisoning on https://t.co/0tU1n2KjjR and https://t.co/RjVNNZNu3D
👨🏻‍💻 @bassemsadaqah ➟ Shopify
🟧 Medium
💰 $3,800
🔗 https://t.co/wvFcHolwwr
#bugbounty #bugbountytips #cybersecurity #infosec

[publiclyDisclosed @disclosedh1]

Shopify disclosed a bug submitted by @bassemsadaqah: https://t.co/p9koM9hGzS - Bounty: $3,800 #hackerone #bugbounty