Bug bounty writeups, the long version
The recon, the dead ends, the exact request that tips the whole thing over, and what it is really worth in impact.
13 writeups
An export-creation route that never checks which organisation you belong to, a notification parameter nobody validates, and an archive that ships the service tokens with it. Full chain to account takeover, zero victim interaction.
An allowlist that covered the column name but not the sort direction, on a public endpoint with no authentication. Blind SQL injection into the production database, reachable by anyone with a browser.
The attachment name was escaped on upload but not in the preview. A Unicode normalisation pass did the rest.
An image tag in an invoice template, server-side rendering, and thirty seconds to confirm outbound network access over DNS.
The back office trusted an identity header that the edge only stripped on one of the two routes it exposed.
Check and decrement separated by a network call. Textbook TOCTOU, confirmed with an HTTP/2 single-packet burst.
The staging build shipped by mistake. Inside it: an internal admin endpoint and a third-party service key that was still live.
The rate limiter counted HTTP requests. GraphQL aliases let me put ten thousand verification attempts inside one of them.
The JWT library looked up the signing key by filename. The filename came from the token, and nobody checked it stayed in the keys directory.