Tim Haines 🇺🇦

Prev founded Percy, Respondly, & Favstar.
Family guy who enjoys 🍦⛷ Ξ.

[篠原 修司 @digimaga]

ロシアがウクライナのデータセンターを相次いで攻撃
↓
ゼレンスキー大統領が報復を宣言。Yandexのデータセンターを相次いで攻撃
↓
サービスが一部停止。経済制裁により新たなGPUの入手難しく、復旧は絶望的
↓
この攻撃によりなぜかロシアのbotの半分が活動しなくなり、Xが少し平和になる←ｲﾏｺｺ

[Tim Haines 🇺🇦 @TimHaines]

@w1j0y_ @NahamSec This

[Tim Haines 🇺🇦 @TimHaines]

Yeah.. If a bug bounty program closes a report as N/A or informative (or doesn't reply in x months), the researcher should get back rights to disclose it.

Better aligns incentives towards keeping people safe and informed.

[International Cyber Digest @IntCyberDigest]

Bugcrowd just banned the security researcher who shared the Lime vulnerability with us, after Yahoo News picked the story up.

[Tim Haines 🇺🇦 @TimHaines]

@marcusjcarey Approved for defender on CVP instantly. Used a US ID.

[Lachlan Donald @lox]

Tried out this whole "remove your unit tests" thing and found at best 6% of our units at @buildkite that weren't actually useful tests.

I genuinely think the whole discourse is flawed. Less tests, but better tests, especially for large codebases. Fast tests > slow tests, which means small tests with few dependencies. When tests fail they should immediately tell you what invariant broke. Not complicated, same as we've been doing in great scale engineering teams for the past decade.

Prompt that I ran with @AmpCode is here: https://t.co/azTD0E5vBB.

[Tim Haines 🇺🇦 @TimHaines]

I'd really like to attend https://t.co/co6UhtBrBV in Tokyo in October, but it's sold out. Anyone have a ticket they'd like to sell?

cc: @offensive_con

[Tim Haines 🇺🇦 @TimHaines]

Kind of mad to be promoting that and encouraging competitors to get stronger, but I really would 🩷 to see an uplift in the whole industry.

[Tim Haines 🇺🇦 @TimHaines]

If you are submitting to bug bounty programs and not already a top researcher, you should have a careful read over this easy-reading skill, and adopt large parts of it.

The skill is used by @BugBunny_ai - the company at the top of H1's business leaderboard all year, signal 7.

[Z A D D Y @Zaddyzaddy]

Bug bounty queues are drowning in AI-generated reports. Platforms, programs, triagers and researchers all pay for it.

So we're open-sourcing the triage skill we use internally @BugBunny_ai to filter out false positives and non-actionable reports. It does two things:
1. Validates the report with an end-to-end test
2. Escalates valid bugs to their highest defensible impact, e.g. a DOM XSS pushed to full account takeover

Every report gets a verdict:
🟢 Green: validated end to end, ready to submit
🟡 Yellow: more work needed first
🔴 Red: do not submit

https://t.co/bPprHrJDUU

[Tim Haines 🇺🇦 @TimHaines]

@mitsuhiko Are there signs?

[Tim Haines 🇺🇦 @TimHaines]

Wish I had seen this at the start of August to set my expectations correctly.

[H4x0r.DZ @h4x0r_dz]

I don't recommend anyone start bug bounty if he didn't already
Not because of the competition
But because companies are lowering their bug bounty tables and they take months to fix/pay for bugs

[Tim Haines 🇺🇦 @TimHaines]

@InsiderPhD @mdp_sec @fransrosen have followed Frans on twitter for over a decade I think, and only ever saw his twitter avatar. So weird seeing him unmasked in a youtube vid.

[Tim Haines 🇺🇦 @TimHaines]

@InsiderPhD @mdp_sec Latest Critical Thinking podcast episode has an interview with @fransrosen - they discuss this near the start. https://t.co/cpSWVMYsqL

[Tim Haines 🇺🇦 @TimHaines]

Have climbed to 2nd spot on @kong's H1 recognition page. https://t.co/pNxuRB6Qk3

Bounties are a little on the low side there, but I really do appreciate their security team's no-bullshit perspective and communication. Good team. cc: @sonicaghi

[Tim Haines 🇺🇦 @TimHaines]

@satoki00 Congrats, that's huge!

I'm going to be in Tokyo for most of October. Aside from offensivecon, do you know of any cybersec events there this month?

[Tim Haines 🇺🇦 @TimHaines]

@moyix Oh, it's sold out. 😢

[Tim Haines 🇺🇦 @TimHaines]

Happy with today's security work. Filed 2 critical severity reports on programs I haven't worked with before. Time to go for a walk in the hills.

[Tim Haines 🇺🇦 @TimHaines]

@moyix Holy good-timing batman. I'm flying there next week and was hoping I could catch some cybersecurity events while there.

Do you know of anything else on in Oct? Will ask the bots soon.

[Tim Haines 🇺🇦 @TimHaines]

Wonder how close Google’s new Argon model is to finding a bunch of these itself.. it’s probably fixing small components as it finds them rather than trying to build full chains right?

[Kim Jinu @uz56764]

We just received a $250,000 Chrome Full Chain bonus! 🎉

We've claimed the second Full Chain bonus of 2026. Only two remain!

Under the rules, every vulnerability had to be a non-duplicate 0-day, and the entire exploit chain had to be completed before any of them were patched.

Huge thanks to @nebusecurity for discovering a V8 vulnerability in just a single day! Also, a big thank you to @_deayzl for collaborating with me on the V8 Heap Sandbox research.

P.S. KVM escapes have been getting a lot of attention. I actually captured the Full VM Escape flag in KVMCTF about three months ago. Hopefully, I'll be able to share that research soon, too!

[Tim Haines 🇺🇦 @TimHaines]

@uz56764 @moyix Congrats! 👏🏼👏🏼👏🏼

[Tim Haines 🇺🇦 @TimHaines]

Could get spicy.

[Anthropic @AnthropicAI]

To secure open-source software, we’re launching OSS Scanner.

We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.

https://t.co/UFFrLUd25U