discodamone

appsec enjoyer

[discodamone @discodamone]

@S1r1u5_ I would guess lots of companies are getting breached and haven't realized it yet or have hidden it

[discodamone @discodamone]

@ledz1996 Hackerone shows the bounty amount is $100k, what's the point in hiding it? Good work though.

[Robert Clapp @RobertClapp]

@AnthropicAI A few days ago I had Claude Fable 5 pick out a donut for me. Today it became clear: the US government knows this kind of power cannot fall into the hands of foreign nationals. God help us all.

[discodamone @discodamone]

@Hacker0x01 It has the same effect if you give an AI agent skills or retrieval. What is the difference between that and training an AI model? Hackerone keeps the benefit and doesn't give it to the third party model provider. Zero benefit for bug hunters. You'll cannibalize your best product.

[discodamone @discodamone]

@0xShaedyW I wouldn't be surprised if most of those reports were valid and they just closed them as info or duplicate. Duplicate is also not counted as a "valid" bug in that metric.

[discodamone @discodamone]

@rez0__ Yeah they have a backlog I got one paid but not til this month and they reduced severity on bounty after triage

[discodamone @discodamone]

@AnthropicAI @rudr4_sarkar The bounty amounts are too low

[discodamone @discodamone]

@5mart__ @MrTuxracer @Masonhck3571 @intigriti There is a security impact but it's too low for them to care about. You shouldn't waste time looking for that kind of bug. Most companies have a higher bar than that to pay for a bug.

[discodamone @discodamone]

@sama Deleted my chatgpt account.

[discodamone @discodamone]

@thedawgyg @immunefi Are you doing smart contracts now?

[discodamone @discodamone]

@thedawgyg @johnumorujo It is what made me interested in security and bug bounties too. Profile created 1 month after that video https://t.co/IMQViQDPN6

[discodamone @discodamone]

@nnwakelam @hackingforbeer Also avoid antiseptic mouth wash to avoid killing good bacteria that make the beet powder useful

[discodamone @discodamone]

@IceSolst I tried it and immediately got blocked by cloudflare bot detection. In burp there's a plugin to bypass that by changing the TLS fingerprint but I didn't see any simple workaround for caido so I went back to burp.

[discodamone @discodamone]

@InsiderPhD Unless the company pays depending on cvss then I set it to the highest reasonable cvss

[discodamone @discodamone]

@InsiderPhD Cvss is dumb and im lazy that's why every bug I report doesn't use cvss

[discodamone @discodamone]

@Masonhck3571 Oh and also it's been a while since I was actively doing bug bounty so who knows maybe it's not as good anymore

[discodamone @discodamone]

@Masonhck3571 I've had good experiences with them before and they at least usually respond and pay quickly. Not a bad program overall compared to others but the cvss reasoning is bad.

[discodamone @discodamone]

@VivekxK @richardhenry @Chase @TheJusticeDept I agree and think it's wrong, just thought it was legal

[discodamone @discodamone]

@VivekxK @richardhenry @Chase @TheJusticeDept Isn't this legal? As far as I know, price discrimination is only illegal in a few circumstances. I think student discounts would be illegal if charging different prices by user agent is illegal.

[discodamone @discodamone]

@pxmme1337 I resubmitted the same bug with a bypass for their fix and got duped for a bug that was submitted before it was resolved