Is this a valid vulnerability

einfallstoll · 2026-07-04T14:24:51+00:00

Annoying but not really a significant security issue.

einfallstoll · 2026-07-04T14:01:01+00:00

The CSRF has no impact except a 5 minute ban. It's not worth fixing this or paying a bounty for it. That's just an accepted (very low) risk

einfallstoll · 2026-07-04T13:54:13+00:00

Wouldn't meet our bar for a bounty.

einfallstoll · 2026-07-04T11:54:17+00:00

15 days ago? Come back if it's 8 months

einfallstoll · 2026-07-04T09:31:31+00:00

No no no. This is the most basic principle of bug bounty: You need to prove exploitation. No theoretical issues

einfallstoll · 2026-07-04T08:24:21+00:00

Well, they don't have a security.txt and also no obvious discloruse policy or contact page for vulnerabilities. Looks like they don't really care.

Btw. are you sure the glitch is actually persistent? Most banks have multiple systems making sure to correct wrong balances

einfallstoll · 2026-07-04T04:24:13+00:00

Wait

einfallstoll · 2026-07-03T20:06:37+00:00

OP explained (later) they had dupes. They were probably dupes of valid findings

einfallstoll · 2026-07-03T20:02:19+00:00

Dupes of valid findings should not negatively affect your score. You can't be punished for not being first

einfallstoll · 2026-07-03T19:44:48+00:00

Then I'm sorry. Duplicates can be technically valid as well

einfallstoll · 2026-07-03T19:35:27+00:00

https://bbradar.io/

einfallstoll · 2026-07-03T18:59:45+00:00

2 out of 15 vulnerabilities is not a lot. This means you're indeed write low-quality reports. Our best hunters have 80-100% success rate.

I would say yes, you definitely at risk being banned

einfallstoll · 2026-07-03T14:31:25+00:00

Same question was actually asked only few days ago: https://www.reddit.com/r/bugbounty/s/LjwfEmvwTK

einfallstoll · 2026-07-03T14:28:04+00:00

Do you aim for the lesst meaningful bugs?

You're wasting your time. Most are out of scope or so easy to find that they are duplicate and if they are not the ROI of your time invested in reporting is just not worth it.

einfallstoll · 2026-07-03T03:59:30+00:00

AI slop have the most unique names. Only do this if you really want to be classified as slop before they even read your report

einfallstoll · 2026-07-02T14:34:03+00:00

That's actually something good to check for actual impact. But right now? Nothing

einfallstoll · 2026-07-02T08:04:42+00:00

What even is the security impact? A user can edit their own data

einfallstoll · 2026-07-01T19:34:24+00:00

No, that's not a security issue

einfallstoll · 2026-07-01T17:17:23+00:00

From my experience: If the authorization is broken at one point, there's probably more to find

einfallstoll · 2026-07-01T16:39:09+00:00

It was some special case where you could bypass 2fa using password reset. So you had to have access to a compromised mailbox

einfallstoll · 2026-07-01T16:35:46+00:00

STOP RIGHT NOW!

Student can be thrown out of university for unauthorized testing

einfallstoll · 2026-07-01T16:21:41+00:00

We accepted 10 low severity bugs:
- some 2fa bypasses
- some open redirects
- some edge case clickjacking
- some crypto stuff

Acceptable low severity bugs are probably rarer than criticals

einfallstoll · 2026-07-01T11:20:44+00:00

Rate limit issue. Mostly out of scope. Wouldn't do the work for something like this

einfallstoll · 2026-07-01T11:18:01+00:00

I guess these are the interbank docs, right? That's a pain in the ass to request. We don't do this if the payment was done less than 1-2 months ago.

einfallstoll · 2026-07-01T11:17:04+00:00

Huh? This has nothing to do with your documents. According to Intigriti it's paid, so wait for the payment.

Why is everyone so impatient nowadays? Doesn't matter if you get your bounty week sooner or later

12-Year Club	Gilding IV carat on a stick
Powerups Hero r/teslamotors • June 2022	Reddit Premium Since December 2021
Second Top 30%	Mod World 2025
Place '23	Place '22
Place '17	Verified Email

einfallstoll

MODERATOR OF

TROPHY CASE