About

I'm @0xmel. I hunt bugs on private bug bounty programs, mostly on web applications and the APIs behind them, and I write up what I find at a length nobody asked for.

Why this blog exists

Most writeups you find are the highlight reel: the payload that worked, the screenshot, the bounty amount. They are useful as a catalogue and useless as a method. You cannot tell, reading them, whether the author found the bug in four minutes or four days, what they tried first, or why they looked at that endpoint at all.

So the articles here are the long version. The recon that led somewhere and the recon that did not. The requests exactly as they were sent. The two hours spent on a parameter that turned out to be ignored server-side. If a lead went nowhere, it stays in the article, because more often than not the dead end is what explains why the next thing worked.

How a writeup gets made

Every finding here comes from a real program, under its rules, with two accounts I control so I can prove a boundary crossing without touching anyone's data. I stop at the minimum proof: enough to make the impact undeniable in the report, and not one record more. When a chain could keep going, the article says so and stops anyway, because that line is the difference between research and an incident.

The code blocks are real. Values are truncated or masked, never invented, and when something is masked you see a black bar rather than a plausible-looking substitute. I would rather you see that information is missing than quietly give you a fake token.

Redaction and disclosure

Every program mentioned here is private. Company names, real domains and identifiers are replaced with target.tld and redaction bars, and the redacted text is removed at build time rather than hidden with styling, so it is not sitting in the page source waiting to be read.

Nothing is published before the fix is deployed and the team has agreed in writing. Bounties are shown as a rough tier, never an exact figure: an exact amount, crossed with a date and a severity, is enough for a program to recognise its own report in an otherwise anonymous article.

Found something that shouldn't be here?

If you think an article leaks something it should not, or you recognise your own product in one and would rather it came down, email me. I take it down first and we talk afterwards. That is not a negotiating position, it is just the right order to do things in.