Ertugrul

Bug Bounty Hunter, 23, [email protected],🇹🇷

[Ertugrul @ertugrulphp]

@joaxcar Congrats Johan!!

[Ertugrul @ertugrulphp]

@bugraeskici @amazon

[Ertugrul @ertugrulphp]

@ProofOfBug @FloeLabs @AlexQuellsIt The same thing happened to me. They fixed the vuln after closing my report with a single disrespectful and unprofessional type. This is so funnyyyy

[Ertugrul @ertugrulphp]

@bangjelkoski @Lahnshen @injective You don’t even believe what you’re saying😂

[Ertugrul @ertugrulphp]

@Lahnshen @injective @immunefi 66579

[Ertugrul @ertugrulphp]

The same kind of situation applies web2 as well on @injective. I found a valid issue, and the team actually fixed it. But after fixing it, they closed my report as “out of scope”

According to @immunefi, if a reported vulnerability is fixed, the researcher should be rewarded+

[f4lc0n @al_f4lc0n]

I Saved Injective's $500M. They Pay Me $50K.

I like hunting bugs on @immunefi . I'm decent at it.

- #1 — Attackathon | Stacks
- #2 — Attackathon | Stacks II
- #1 — Attackathon | XRPL Lending Protocol
- 1 Critical and 1 High from bug bounties (not counting this one)

Life was good. Then I found a Critical vulnerability in @injective .

This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk.

I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity.

Then — silence. For 3 months. No follow up. No technical discussion. Nothing.

A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either.

I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten.

I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve.

Full Technical Report: https://t.co/lki2tL9bxw

[Ertugrul @ertugrulphp]

However, my report has been marked as “closed” for a long time, and the @immunefi mediation team still hasn’t responded.

Honestly, this is really frustrating.

[Ertugrul @ertugrulphp]

@al_f4lc0n @immunefi They fix the vulnerability then close the report by saying "Out of scope”
This happened to me recently.

Clearly scam👍🏻

[Ertugrul @ertugrulphp]

The company has over 10m users and the annual premium plan is $80

"Reports that do not relate to legitimate data privacy or security concerns may be accepted as Informational, but will not be rewarded"

[Ertugrul @ertugrulphp]

Still alive..

#BugBounty

[samet g. @samog0d]

Introducing samoscout - It combines 53+ native passive sources (more than subfinder, oneforall) with optional active enumeration. It runs subdomain level discovery and even uses a built-in LLM to predict new, undiscovered subdomains.

#recon #bugbounty #cybersecurity #opensource

[Ertugrul @ertugrulphp]

@samog0d @Apple Congrats!

[Ertugrul @ertugrulphp]

@coinbase @wiz 👍🏻

[Ertugrul @ertugrulphp]

CVSS > Bugcrowd Vulnerability Rating Taxonomy

#bugbounty

[Immunefi @immunefi]

He's been on fire lately.

@ertugrulphp just secured a $5,001 critical web/app bug bounty yesterday.

It's his fifth critical so far.

Keep it up!

[Ertugrul @ertugrulphp]

@0xpessimist @immunefi @OddlySpecivik 😼

[Ertugrul @ertugrulphp]

.@immunefi in Cappadocia🌄🎈👾

[Ertugrul @ertugrulphp]

@0xtotem @immunefi Looks cool!

[Ertugrul @ertugrulphp]

@0xTimofey @immunefi I'd like to try it but I have acrophobia :/

[Ertugrul @ertugrulphp]

.@immunefi 👾