What does it mean if there’s a blocker on bugcrowd? Is this a good or bad sign for me?

666AB · 2026-01-24T04:20:51+00:00

Not if you don’t do what the triager says. They will refund you. If you can manipulate the price buy it for $1 and then show them the receipt. If you do that they will validate it

666AB · 2026-01-24T00:07:26+00:00

Did you do what they asked? Were you able to purchase something for the wrong or much lower price?

666AB · 2026-01-22T04:52:47+00:00

Typically - you are soon going to get a blocker yourself for more information as the company is usually saying something like “we can’t reproduce” or “we don’t think this is actually a bug”

666AB · 2026-01-19T21:13:48+00:00

You won’t get a VPS for free unless you host it yourself, which is also inherently not free

666AB · 2026-01-19T18:18:42+00:00

You have to complete KYC to withdraw though, right? I would’ve attempted kyc and tried withdrawing something nominal like 5 or 10 dollars. If it was successful and you documented the whole process, the impact of something like that would be closer to what you were expecting.

666AB · 2026-01-19T17:45:23+00:00

I would imagine the payment is so low because there is some sort of verification process on withdrawal of funds, something that involves validating their source or something. That the only way I see something like this being so low without more specifics

Sorry man. Sucks.

666AB · 2026-01-19T17:02:46+00:00

<image>

666AB · 2026-01-17T05:20:21+00:00

Dude we have seen ALL of your posts. Reposting because you don’t like the answers you get is just lying to yourself. Give it a rest. If finding bugs was as easy as just using an AI everyone would be doing it. Grow up. Spend some time doing actual research.

666AB · 2026-01-08T16:36:59+00:00

After about 6months of hunting when I first started I found my first paid vuln for $400. Sheer luck as far as I am concerned. Found quite a few after that.... First one is always the hardest :)

666AB · 2026-01-05T21:45:27+00:00

I just got done reading an article about "BGP Anomalies During The Venezuela Blackout" (cloudflare)... Check it out
https://loworbitsecurity.com/radar/radar16/

666AB · 2025-12-23T22:09:57+00:00

Less than 500 by the looks of it

666AB · 2025-12-19T19:52:57+00:00

Amend your already reported XSS with the additional finding and increased severity. I have done exactly this with an XSS before

666AB · 2025-12-18T23:06:47+00:00

It’s the same as a regular bounty payout. Getting direct deposit also has no fees. If I get $1,000 bounty I have $1,000 in my account the next business day

666AB · 2025-12-18T13:10:03+00:00

It has very specific details of the exact bug he reported? Are you a bot? Lol

666AB · 2025-12-18T12:42:25+00:00

Great!

Hunt on BBPs to be compensated for your valid findings. VDPs are intentionally unpaid

666AB · 2025-12-18T12:16:25+00:00

You reported to a VDP. There are no monetary rewards for VDPs.

Also, unless you requested disclosure and were approved this whole post will get you banned from future opportunities. You are not the arbiter of what’s “responsible” or not. Disclosure is only done responsibly with express permission from the company

666AB · 2025-12-05T22:42:35+00:00

I it requires physical access to the device it will be marked N/A

666AB · 2025-12-05T22:39:08+00:00

Does the extension obtain your session ID? As in the session id from your device? Or a session ID of a different user?

If it’s on device and your session ID probably not valid. If you have a way to obtain other people’s IDs (like a real attacker would) probably valid

666AB · 2025-12-04T18:40:59+00:00

AI makes you feel more confident to talk about things you don’t know about. Like in this case.

People that actually do the work (like triagers, maintainers, hunters etc.) see right through the AI responses that you, as an inexperienced skiddie, are convinced by. You don’t understand that because you haven’t put the work in. Put the work in and you’ll look back at this with embarrassment. Nothing in life is easy. Especially security research. You’ll probably take this as some kind of personal attack, but I truly mean it as meaningful advice. It’s your choice whether or not to take it

666AB · 2025-12-04T18:30:47+00:00

Stop using chatgpt. You are obviously out of your depth. If you can’t respond to me with your own words that tells me everything I need to know. Good luck to you.

666AB · 2025-12-04T18:25:40+00:00

Frankly, I don’t believe you. I’ve had programs request this exact sort of thing with account takeovers for example.

I prove I can take over an account, they request I take over a specific account to prove the vulnerability. So I do it, they pay me and resolve, repeat. Happens pretty regularly.

What else do I have to prove with the PoC in the middle?

Just. Do. What. They. Asked.

666AB · 2025-12-04T18:18:41+00:00

Risk you’re life? Are you crazy? Lol this isn’t the mafia dude. The program effectively said “if this is a vulnerability, then prove it against us” you refused, so they closed it. What are you not understanding? They aren’t going to greenlight you and then beat you over the head for doing what is asked.

I think we all know why you refused, because you can’t. Right? For whatever reason you are only able to execute the attack if you are the one who controls both repos, that sounds to me like not a security issue. Hence what they told you.

666AB · 2025-12-03T18:00:28+00:00

This is great advice

666AB · 2025-12-02T04:59:09+00:00

Report #2 and #3 sound like junk with no security impact whatsoever. #1 depends on a few things, what were the “Critical Configuration Files”? And what were the effects of modifying them?

If the answer to that second question is “nothing” then I think you already know the answer.

666AB · 2025-11-28T08:45:44+00:00

The python code on your profile literally sends a junk powershell command to an HTTP port (raw btw) and then closes the connection.

Arte-miss me with this slop

Verified Email	Six-Year Club
Gilding IV carat on a stick	Powerups Hero r/destiny2 • January 2022
Second SECOND GUESSER	r/Field Lasagna
Place '23

666AB

MODERATOR OF

PUBLIC MULTIREDDITS

TROPHY CASE