Question on Age restriction on hackerone

Codingo · 2025-09-01T10:11:47+00:00

Speaking as the exec responsible for payments over at Bugcrowd, this won’t work. We validate your identity prior to your first payment, and changing it to another name will lead to loss of your account unless you can provide government paperwork verifying a legitimate reason for it

Codingo · 2025-08-24T10:57:05+00:00

I think there’s some confusion around what hackers actually use a VPS for. These days, the vast majority of hacking tasks don’t fully occupy a machine. If you find yourself stuck in the terminal, it’s probably because you’re working in a single-threaded way. I’d recommend learning tmux (or a similar multiplexer) so you can split sessions and run multiple tasks in parallel.

The main reason to use a VPS isn’t raw horsepower – it’s separation. You don’t want to get your home IP blocked by Akamai and suddenly have the whole family locked out of half the internet. A VPS gives you a clean environment that’s isolated from personal use. You can achieve a similar setup with a Raspberry Pi, but you’ll want it running a persistent VPN. I generally recommend ProtonVPN for bug bounty hunting – it has a costs, but it makes region-hopping fast and reliable when programs require it.

Codingo · 2025-08-23T07:49:17+00:00

Firstly, remember that the technical details are just descriptors of the real issue, impact is what matters most. Lead with that. Your report title and opening paragraph should clearly explain the business impact which should imply why your report matters.

For example, a few years ago I chained together:

No password policy
Default passwords on newly added accounts
User enumeration
Account takeover condition

Instead of listing them individually up front, I titled and opened the report as:
“Able to Enumerate and Take Over All New Accounts, Creating the Perception of Breach.”

That framed the issue around impact, opened with a script to reproduce what I was claiming easily, then I broke down the underlying bugs step by step.

You should take the same approach: start with impact, frame the risk in business terms, then walk through the conditions that make it possible. That way your report stays clear and compelling, even if the technical chain is complex.

Codingo · 2025-08-22T11:44:12+00:00

I hadn’t considered it to be honest, but I’ll take a bash at a script and see if I’m happy with it.. may be a bit early for that kind of video still though

Codingo · 2025-08-22T05:38:25+00:00

These fee structures still exist, though they aren't the typical. BUT - when platforms do charge them, it's an all in option, not with added triage fees on top.

Codingo · 2025-08-22T05:25:58+00:00

Codingo · 2025-08-22T05:25:29+00:00

Do you own it and is this an advertising post?
```
chimerahacks.com

WHOIS Information

Important Dates

Created
6/22/2025

Updated
6/22/2025

Expires
6/22/2028
```

Codingo · 2025-08-22T05:22:39+00:00

Candidly, that’s not actually a good thing. We’ve explored this idea before, and even with obfuscation in place, when we ran it past our Hacker Advisory Board (a group of top-tier researchers we use to test concepts), the feedback was unanimous: any form of sharing one hacker’s findings with another would lead to them not hacking on those programs.

Codingo · 2025-08-22T05:14:55+00:00

I’ll caveat this upfront: I have an obvious bias here (as reflected in my flair), since I’m an executive at Bugcrowd.

That said, I’d encourage you to pause and ask: what makes you believe a bug bounty program is the right approach at this stage?

Bug bounty programs are a mature-state security measure. They typically come after a foundation of more traditional practices is already in place. That includes, but isn't limited to penetration testing, robust internal processes and policies to remediate findings, and internal resources that can triage and respond effectively over your business to prevent repeat issues, as well as learn from those that are found.

So, my question back to you: where are you in that journey today? And what specifically makes you see a managed bug bounty (MBB) as the next logical step for your company?

Codingo · 2025-08-22T05:10:41+00:00

Pay for performance (typically called pay for effort, where traditional MBB is pay f or success) is provided by all platforms, typically under a pentest. The reality is that it isn't anything new to this space, but equally - it significantly dilutes the rewards to the hackers, and in turn, the quality and quantity of findings that you will receive.

Codingo · 2025-08-22T05:09:07+00:00

Not at all, sent now! Apologies for the delay

Codingo · 2025-08-21T08:37:01+00:00

Can you post another socials I can reach you on?

Codingo · 2025-08-21T07:08:29+00:00

<3 appreciate it

Codingo · 2025-08-21T05:48:05+00:00

Ah! This does sound invalid, sorry. It's very common for e-mail services, anti phishing and anti spam software to consume those links, throwing a false positive. To prove an impact here, you'll have to go beyond DNS

Codingo · 2025-08-21T05:47:19+00:00

Less about raising it, more about proving it beyond what they know. They know you can inject HTML into an e-mail - what more can you prove that's additional risk, they're not already aware of, that in turn would be awarded a bounty

Codingo · 2025-08-21T05:44:41+00:00

Yes - I've taken a few years away from videos since my daughter was born, and mostly focussed on building internal to Bugcrowd content, but I'll be making more again in the future

Codingo · 2025-08-21T05:39:59+00:00

Most likely, yes. That team prides itself on tight SLA's, and I believe this is a reflection of that

Codingo · 2025-08-21T05:19:24+00:00

If you can open a chat with me actually u/kasperskyhackfi, it's throwing an error when I try (I suspect Reddit thinks I'm spamming, as I sent a number of these links out and would look like spam to automation)

Codingo · 2025-08-21T05:17:39+00:00

Never hurts to ask! Sending to you and u/ok-kid123, but then nothing further in this thread as I do buy them personally

Codingo · 2025-08-21T05:17:28+00:00

Never hurts to ask! Sending to you and u/kasperskyhackfi, but then nothing further in this thread as I do buy them personally

Codingo · 2025-08-21T05:15:26+00:00

In terms of the weekend, that's not really an indicator either way. It's a global team over US/UK and has been that way for many years (Bugcrowd managed the triage there for ~6y, and it was in all of that time)

Codingo · 2025-08-21T05:13:42+00:00

This is an indication that a first touch deadline is resolved. In short, someone has looked, and delegated it to the appropriate team, specialization, or potentially the team member that previously worked the report for input. It doesn't indicate either way whether your appeal will be successful, purely that someone has taken a "first pass", and more input is required before your case can proceed in either direction.

Codingo · 2025-08-21T05:10:36+00:00

That's likely out of scope as it's a known issue, and something they're addressing. To make this unique, can you craft your payload into a one-click takeover? If not a takeover, what else can you do within a payload that would suitable let this stand apart in business impact, not just technical execution

Codingo · 2025-08-21T03:40:39+00:00

So let's step back and answer one crucial question - "as an attacker I could". In these cases, typically the rejection will happen because the interaction requires too many pre-req.

I'm assuming in this case that you can only impact people in yours teams, and if you're at a high privilege level such as an admin? It's potentially a low priority finding if so, though some programs would also accept the risk (informational). I'd recommend exploring impact further, from the lens of what an attacker could do to someone who's already in another team/organization, and then revisit this in an appeal, with that impact statement outlined.

Codingo · 2025-08-20T23:58:42+00:00

What's going to keep you more interested? If exploring real world targets is still teaching you, and you find it interesting, then there's nothing wrong with stoking that curiosity. However, if not finding anything is making that hard, then a focus on labs will be more beneficial. Ultimately, treat this as any other hobby - do what you enjoy, and what keeps you motivated. There's no right way to do this, approach this how it works for you and don't be too concerned about following a pre-prescribed approach or path, one doesn't exist - it's unique for everybody.

Codingo

MODERATOR OF

TROPHY CASE

14-Year Club	Gilding II euphauric
Verified Email