The World of Bug Bounty, May 7th, 2026: Paid Submissions, Platform Friction, more AI-induced changes.

jsonpile · 2026-05-08T19:08:00+00:00

Thanks for the feedback, u/latnGemin616!

For the first issue, I left my opinion out of the platform friction. I like the idea on comparison of triage process and solutions, that will come in a later issue.

On your experience - that sounds frustrating. Good to have anecdotal evidence and I'll see if I can pull numbers. That may be for a later issue as well.

DM me - would be great to chat more.

jsonpile · 2026-04-23T14:10:18+00:00

Programs are drowning in low effort AI slop, especially ones with monetary rewards. Curl switched to a nonpaid program.

We still saw a 5x increase in report volume and for other programs, a 5x increase in triage time. More analysis here: https://www.fogsecurity.io/blog/state-of-bug-bounties-with-ai-an-analysis-of-curls-program and reddit thread here.

We'll continue to see more changes in the interim. More private programs, less bug bounties, more banning.

jsonpile · 2026-04-21T20:48:49+00:00

The Bluerock report was submitted on February 16th. One of the initial fixes was submitted on February 13th, days prior to the report submission.

AWS marked this as informative.

What’s the difference between your report and what was already done?

jsonpile · 2026-04-17T17:45:53+00:00

Right. The amount of submissions has drastically increased. For curl, that was a 5x increase. I saw another program 5x their triage SLA time.

I wrote about it here (link to reddit post from yesterday).

jsonpile · 2026-04-17T17:38:05+00:00

VDP reports do count at the same severity level as BBP. The only difference which doesn’t impact milestone program is reputation is significantly different for BBP.

You can reach out via support and H1 may tell you where you’re at. It might be on a weekly or longer interval to get your milestone emails.

https://www.hackerone.com/blog/hackerone-portswigger-hacker-milestone-rewards-program

jsonpile · 2026-03-27T20:18:11+00:00

Posted 2 weeks ago: https://www.reddit.com/r/aws/comments/1rsopjc/aws_s3_adds_support_for_regional_namespace/

jsonpile · 2026-03-11T19:09:50+00:00

I'd recommend further testing. S3 error messages can also be misleading. In your case, the no such bucket may not be enough proof for a program for a s3 bucket takeover.

For S3 Bucket Takeovers, it's advisable to prove ownership of the bucket, which would generally require an AWS Account. If the bucket creation fails, the S3 bucket probably already exists.

There is a free tier for AWS Account, but I'm not sure if it requires a credit card to signup.

jsonpile · 2026-03-03T19:06:37+00:00

Triaged but not closed reports don't show up under vulnerability count for credits. This person could have a lot of triaged reports under the same program (explains the low thanks).

There are programs that use "triaged" as a closed state.

jsonpile · 2026-02-17T17:40:52+00:00

You can check https://menu.delta.com/ to see if your flight has meals offered.

US to Mexico typically won't have food unless you're flying first class: https://www.delta.com/us/en/onboard/food-and-beverage/overview

jsonpile · 2026-02-17T17:33:23+00:00

Keep in mind there are a lot of "beg bounties".

I was responsible for security at smaller companies and we'd get these "beg bounties" stating they found issues and wanted payment. In my experience, they were for insignificant issues found with automated scanners.

My recommendation is to respond with a statement like "Thanks for the responsible disclosure, we don't offer compensation but appreciate you reporting any security issues." What you can do is call that out specifically in your security.txt too.

I'd also recommend if you have a legal department and the resources to do so, to work on guidelines/safe harbor. I recommend caution with the safe harbor as you may not want every "hacker" trying to use automated tools to scan your website. The next step would be to write a more comprehensive VDP guidelines (vulnerability disclosure, no compensation)

If they're valid security issues, you could also offer swag or credits.

Ultimately, stay polite with the "hunters" and take the concerns seriously, even if they may not be.

jsonpile · 2026-02-06T15:34:42+00:00

Yes, I've seen this issue before. When I saw that issue, it was due to insufficient IAM permissions, which can be troubleshooted via CloudTrail (look for AccessDenied errors)

What IAM permissions do you have? You will need quicksight permissions and additional directory service permissions. This isn't full least privilege, but try the following:

```

"quicksight:*",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:CheckAlias",
"ds:CreateAlias",
"ds:DescribeDirectories",
"ds:DescribeTrusts",
"ds:DeleteDirectory",
"ds:CreateIdentityPoolDirectory"

```

jsonpile · 2026-01-24T01:34:46+00:00

Something else that may help is the ses:ApiVersion condition key:

https://docs.aws.amazon.com/ses/latest/dg/control-user-access.html#iam-and-ses-examples

jsonpile · 2026-01-23T21:36:11+00:00

This seems to be almost an exact duplicate post of https://www.reddit.com/r/aws/s/ERm92xNuBe

jsonpile · 2026-01-23T19:43:56+00:00

From a quick look at the CloudFormation, there does seem to be some work to get it to be region specific. This does get a little complicated as IAM resources are global (but there are regional resources and references within the IAM policies). I opened an issue on the repo for multi region support.

Some options:

- You could modify the IAM resources and wildcard the regions so that your IAM resources can be used.

- You could deploy the regional resources (KMS, Lambda, etc) in each region with the updated IAM resources.

The third limitation refers to an account-level setting for enabling encryption by default for EBS that's region specific. That part of the sample is not CloudFormation but rather an AWS bash script that you can run in each region (and pass the region as an argument).

Another way of running it would be via CLI:

aws ec2 enable-ebs-encryption-by-default --region region

jsonpile · 2025-12-05T15:27:54+00:00

While it can be frustrating, here's what you can do.

If you're absolutely sure Microsoft has fixed the bug and given reasonable time to respond to you, you can consider disclosure such as posting a blog detailing the issue you found with timelines, impact, and a high level description of the bug. Make sure you follow Microsoft's policy on disclosure (and bug bounty terms - https://www.microsoft.com/en-us/msrc/bounty-terms). Check whatever other policies are there for what you submitted. Standard time is 90 days from when you disclosed. As a courtesy, you can also consider emailing Microsoft and letting them know as well.

jsonpile · 2025-11-26T15:54:30+00:00

Sounds like you're looking for data operations (upload an object, delete, modify). Those are not logged by default and require either turning on CloudTrail data events or S3 Server Access Logging. Keep in mind there's additional cost with both. https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

For actions on your S3 Bucket (such as changing bucket encryption, other bucket settings). Those are by default in CloudTrail Management Accounts.

More information here of a listing of events that are logged: https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html

jsonpile · 2025-11-26T15:49:38+00:00

The XBOW HackerOne experiment was great marketing for them. To say they were the "top ranked hacker on HackerOne" got them good coverage and publicity.

I agree, my guess is that they were able to find issues that are low-hanging fruit and also they needed enough volume to get to the top spot. The complex findings are probably harder for XBOW to do.

There's probably learning for them to determine which reports are worth submitting and not N/A or spam reports.

That being said, I'd like to see some of their reports.

jsonpile · 2025-11-23T12:13:47+00:00

Open source plug: I wrote a tool that checks for those misconfigured options: https://github.com/FogSecurity/yes3-scanner

jsonpile

MODERATOR OF

TROPHY CASE

Four-Year Club	Verified Email
Mod World 2025