Ciarán Cotter

• Irish/Japanese web/AI hacker from Cork, living in Scotland • Founder @StarstrikeAI • BT6 Operator • Newsletter @

[Ciarán Cotter @monkehack]

I won Best Chrome VRP Researcher at Bugswat Singapore! I also shared Best Meme with @inspector_amb. I’ll be talking (in abstract) about some of my exfiltration and guardrail bypassing techniques at NahamCon in California next month!

[AJ Stuyvenberg @astuyve]

private keys from 8 intermediate CA certs have been compromised (eMudhra)

Happy "Update everything" day to all my pager-carrying friends

https://t.co/7ASSy72Rxg

[Ciarán Cotter @monkehack]

@joaxcar @rez0__ RIP

[Ciarán Cotter @monkehack]

I’m liking this recent trend of people outside the bug bounty community calling out the low max bounties of some very large companies.

[Ciarán Cotter @monkehack]

@zack0x01_ This seems to be a program decision, not a HackerOne decision

[Ciarán Cotter @monkehack]

@rez0__ It would be a net good because the companies would be a bit nicer to us if their fuckups got millions of impressions

[Ciarán Cotter @monkehack]

@pxmme1337 🔥

[Ciarán Cotter @monkehack]

@PikuHaku That’s CRAZY lmao. “Why yes, this data only RESEMBLES all of our customer PII”

[Ciarán Cotter @monkehack]

As someone who got an N/A yesterday because the company decided that my 0-day wasn’t their responsibility, limiting based on N/As is definitely not the right way.

[Angel Montes @_N0xi0us_]

@Bugcrowd is becoming the anti-platform.

Using N/A to calculate accuracy and limit reports is terrible. Soon, many researchers may not be able to submit reports.

How they use N/A:
• Took 20 days + fixed → N/A
• No time to understand → N/A
• Don’t understand scope → N/A

[Ciarán Cotter @monkehack]

@pxmme1337 made a card game based on Wikipedia and it's ridiculously addictive. He's looking for feedback so do him a favour and check it out (and do me a favour and use my invite link, I'm addicted to it): https://t.co/DgkB7FYx2b

[Pomme @pxmme1337]

I accidentally got addicted to my own game ffs

https://t.co/AeFQFEmMed

[Logan Kilpatrick @OfficialLoganK]

Introducing Gemini 4 Argon, our new frontier model, rolling out to cyber defenders starting today, and more widely as soon as possible. I am really excited by the progress we have made here. Argon is priced at $2 in and $10 out during introductory pricing!

[Ciarán Cotter @monkehack]

🐵 MonkeHacks #101
Cork LHE, Moving, Prompt2Pwn

https://t.co/8yE9l15iqL
#bugbountytips #hacktheplanet #BugBounty

[Ciarán Cotter @monkehack]

Bug bounty these days is like:
"We regret to inform you that BigStinkyCompany is pausing all submissions until further notice. We're excited to add "https://t.co/mEllrtwFjQ" to our assets after this break, but we're lowering our Medium and Low payouts in line with industry standards"

[Ciarán Cotter @monkehack]

@rez0__

[Martin Kemka @mkemka_]

Extension kits for the microduck might be popular. Here is one to voltron five ducks into a macroduck.

[Ciarán Cotter @monkehack]

@caffeinedoom @rapid7 HackerOne’s mobile UI hasn’t worked well in living memory

[Ciarán Cotter @monkehack]

I wish more tokens were spent on making existing software more efficient instead of generating new slop code

[Ciarán Cotter @monkehack]

@LiveOverflow I tried but it rejected my attempts to get ID verified again

[Ciarán Cotter @monkehack]

@S1r1u5_ This type of thinking extends to other fields too, as evidenced by GPT using techniques from other areas of mathematics to solve unsolved problems