Imamul Mursalin

Security enthusiast aka Cyber Security Researcher

[Imamul Mursalin @vulnbot0]

Alhamdulillah ,
I become father of a boy . Pray for my son & wife

[Imamul Mursalin @vulnbot0]

@immunefi @0xjonah1 @Daniel_Immunefi @alexpds45

[Imamul Mursalin @vulnbot0]

5 dups in a raw 🥲

[Imamul Mursalin @vulnbot0]

DOM XSS via Unsanitized Filter Input in ECC Queue Logs

[Imamul Mursalin @vulnbot0]

It’s totally disappointing @gitlab agent auto closed my recent submission by just matching the submission title . The original report currently on resolved state then how I got duplicate of that submission? Please @gitlab have a look on this .

[Imamul Mursalin @vulnbot0]

@claudesfun thanks

[Imamul Mursalin @vulnbot0]

not bad 😪

[Imamul Mursalin @vulnbot0]

Companies should value security researchers who find and responsibly disclose these issues instead of dismissing the impact after fixing them.

[Imamul Mursalin @vulnbot0]

I reported an OAuth flaw back in February that could lead to account takeover of users’ connected accounts.

After the issue was fixed, the response was essentially “there’s no impact” because the believe the flaw is on the OAuth provider side.

[Imamul Mursalin @vulnbot0]

But if an application’s OAuth integration can be abused to access users’ accounts without proper authorization, the impact is real regardless of where the root cause sits.

[Imamul Mursalin @vulnbot0]

I reported an OAuth flaw back in February that could lead to account takeover of users’ connected accounts.

After the issue was fixed, the response was essentially “there’s no impact” because the believe the flaw is on the OAuth provider side.

[Imamul Mursalin @vulnbot0]

I reported an OAuth flaw back in February that could lead to account takeover of users’ connected accounts.

After the issue was fixed, the response was essentially “there’s no impact” because the believe the flaw is on the OAuth provider side.

[Imamul Mursalin @vulnbot0]

@x0xHasan endpoint ta ko
duita duplicate khaiya ashi

[Imamul Mursalin @vulnbot0]

@jeetbhdr @resend see

[Imamul Mursalin @vulnbot0]

@jeetbhdr @resend that’s not the case here , I don’t care about reward but first the implemented fix then also notified me that the issue on their control have been remediated after that when the rewards part arrive they just declining that root cause was not on their side . Why?

[Imamul Mursalin @vulnbot0]

researchers actually find serious vulnerabilities.

@resend I’m asking for a transparent explanation of why a confirmed account-takeover vulnerability with no victim interaction does not qualify for a reward.

[Imamul Mursalin @vulnbot0]

it, and afterward the contribution is simply considered ineligible for a reward?

From a researcher’s perspective, this honestly feels like a scam.

If companies want security researchers to spend their time protecting their users, there needs to be transparency and fairness when

[Imamul Mursalin @vulnbot0]

@4osp3l @Hacker0x01 youre lucky I got banned for the same reason . 6 years of hard work disappeared like never existed. I have tried several times to contact the mediation team but nothing happened

[Imamul Mursalin @vulnbot0]

@hrishibhat hey what’s up
Im interested
let me know what’s the process

[Imamul Mursalin @vulnbot0]

Confusing llm is fun

[Imamul Mursalin @vulnbot0]

Maybe he forgot to pay 🥲

[Imamul Mursalin @vulnbot0]

@0trusts account takeover

[Imamul Mursalin @vulnbot0]

4 digits always makes happy☺️👌
Alhamdulillah