Jonathan Bouman retweeted
Funnily enough, I broadly agree with Mr. @DeGatchi. For vulnerabilities like this one which impacts everybody using KVM (read every hyperscaler, every AI lab, every company on the planet really), there should be a fund that pays from all of them.
As Vercel we are trying to do credit to @PaulosYibelo for going down the pass of responsible disclosure!
As Vercel we are trying to do credit to @PaulosYibelo for going down the pass of responsible disclosure!
18
21
286
41,235
Jonathan Bouman retweeted
This is accurate. Without a harmless, easily verifiable PoC, would the report have been taken seriously? Would it have passed triage quickly, or sat vulnerable for weeks/months? Would the triager have pushed back, saying “needs a poc”?
If you’ve worked in the trenches of bug bounties, submitting or triaging thousands of reports, and dealing with escalations then you know how it works *in practice* not in theory.
A harmless poc like this is fine, imo, but the problem is that it takes a skilled researcher to know exactly what is appropriate and what isn’t. I’ve even seen large orgs make bad judgement calls on stuff like this. It’s easy for a less skilled researcher to see something like this and get the idea that it’s okay to do something similar and end up causing harm.
The solution is to educate our up and coming hackers, and set clear guidelines on what is/isnt appropriate.
If you’ve worked in the trenches of bug bounties, submitting or triaging thousands of reports, and dealing with escalations then you know how it works *in practice* not in theory.
A harmless poc like this is fine, imo, but the problem is that it takes a skilled researcher to know exactly what is appropriate and what isn’t. I’ve even seen large orgs make bad judgement calls on stuff like this. It’s easy for a less skilled researcher to see something like this and get the idea that it’s okay to do something similar and end up causing harm.
The solution is to educate our up and coming hackers, and set clear guidelines on what is/isnt appropriate.
i’m tempted to dismiss takes like this as coming from people who haven’t spent much time actually doing vulnerability research or submitting through VDPs, but that’s too harsh. few experienced researchers can reasonably disagree with us.
still, i’d like everyone to read this wiz writeup and tell me whether wiz was acting in bad faith here, or pointing out a glaring security disaster.
oh, wiz does “unprofessional” security research now too?
wiz.io/blog/wiz-resea…
3
3
70
7,586
Jonathan Bouman retweeted
I Went to the World's Biggest Hacker Conference (DEFCON VLOG) 👉🏼 youtu.be/4QQnW170C5g
9
19
241
12,732
Jonathan Bouman retweeted
Things are getting weird (or interesting?) in the vulnerability research space. I published some of my personal thoughts on what we're seeing and what our broad strategy is here:
shubs.io/frontier-class…
shubs.io/frontier-class…
8
101
533
55,430
💡Great read!
Things are getting weird (or interesting?) in the vulnerability research space. I published some of my personal thoughts on what we're seeing and what our broad strategy is here:
shubs.io/frontier-class…
0
0
11
2,543
Jonathan Bouman retweeted
bugcrowd.com/blog/savant-bu…
so the bug bounty community freaked out a few weeks ago when hackerone had a single slide that talked about using AI agents for testing based off our reports. bugcrowd's new strategy sounds even more brazen, sly and egregious.
submit reports -> your "siought process and work) feed into their AI agents -> AI agents find bugs without you (unclear incentive structure).
that's if the technology even works though lol. these days I have trouble even adding collaborators in reports without the app erroring out.
the messaging is so much more slick too. "connect those signals" - does that mean they are training on our reports? at least whoever did this PR release was careful to not blatantly say that they are training on our reports.
but lol what does connecting those signals actually mean at the end of the day? extremely unclear if they train on our reports.
this requires actual transparency from both platforms, not just marketing, and messaging tactics that you use when you're trying to convince you're not a wolf in a sheeps clothing.
so the bug bounty community freaked out a few weeks ago when hackerone had a single slide that talked about using AI agents for testing based off our reports. bugcrowd's new strategy sounds even more brazen, sly and egregious.
submit reports -> your "siought process and work) feed into their AI agents -> AI agents find bugs without you (unclear incentive structure).
that's if the technology even works though lol. these days I have trouble even adding collaborators in reports without the app erroring out.
the messaging is so much more slick too. "connect those signals" - does that mean they are training on our reports? at least whoever did this PR release was careful to not blatantly say that they are training on our reports.
but lol what does connecting those signals actually mean at the end of the day? extremely unclear if they train on our reports.
this requires actual transparency from both platforms, not just marketing, and messaging tactics that you use when you're trying to convince you're not a wolf in a sheeps clothing.
7
34
212
34,061
Very true, don't hide behind "it's not our code". You picked it as your attack surface.
Bug bounty programs are killing their own disclosure pipeline.
Real vuln on something.org.com → CNAMEs to a vendor → program closes as N/A → bug stays open → breach happens anyway.
Microsoft just reversed this. Most haven't.
jdonsec.com/essays/its-you…
0
0
6
1,088
Jonathan Bouman retweeted
Introducing my Bug Bounty Masterclass. 100% free.
I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.
4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.
Finish it hacking real-world applications 🐞
I've made $2,000,000+ finding security bugs. I spent the last year turning my methodology into a complete blueprint.
4 hours of video - foundations, reconnaissance, web proxies, hands-on challenges, and certification.
Finish it hacking real-world applications 🐞
112
341
2,107
262,214
❤️✨
Shoutout to @JonathanBouman @fransrosen @avlidienbrunn for another great year of collaborations. Always a pleasure hacking alongside these legends , we’ve found some really really good crits this year and I get the feeling 2026 will be the same 🫣
1
0
14
2,596
Jonathan Bouman retweeted
A friend found multiple RCE on GitHub Enterprise and it paid minimum crit. Should you hack on GitHub?
#bugbounty
furbreeze.github.io/2025/10/28/vib…
#bugbounty
furbreeze.github.io/2025/10/28/vib…
12
25
203
22,722
🔥🔥🔥
fun times hacking amazon with @JonathanBouman and @fransrosen!! only 14 reports (crits/highs) but managed to win a few awards:
pwnership - most impactful report overall
most impactful issue on scope 1
most # of critical issues on scope 1
most # of critical issues on scope 2
2
0
55
6,335
Jonathan Bouman retweeted
Had lots of fun meeting and hanging out with @H4cktus @_naaash_ @jayesh25 @gr3pme @inhibitor181 @galnagli @JonathanBouman @JR0ch17. Awesome people with good vibes (and good hacking skills ofc ;D). Until next time lads !
7
2
136
8,259
Jonathan Bouman retweeted
We are alarmed by reports that Germany is on the verge of a catastrophic about-face, reversing its longstanding and principled opposition to the EU’s Chat Control proposal which, if passed, could spell the end of the right to privacy in Europe.
signal.org/blog/pdfs/germ…
signal.org/blog/pdfs/germ…
687
8,372
29,255
4,779,585
🥇 1st place at the Las Vegas @Hacker0x01 @amazon Challenge with @zseano ❤️✨, 2 weeks remote + 2 days live at the Wynn.
Real bugs, real impact, patched fast.
Shout-out to @tobias_bouman for crushing it after switching from law to infosec.
DEFCON was madness! Now time to chill 🏖️
Real bugs, real impact, patched fast.
Shout-out to @tobias_bouman for crushing it after switching from law to infosec.
DEFCON was madness! Now time to chill 🏖️
20
1
229
10,853
🙏🙏🙏 @zseano ! Great hacking adventures, tons of new stuff ahead of us. Dream team ❤️
another successful H1 event with the legend @JonathanBouman, great bugs and gaining lots of new insights for future hunts! :)
that's me done with hacking now til september, getting married in 2 weeks so i'm going afk to chill :D
happy hacking, go get them crits✌️
1
0
51
4,101
Jonathan Bouman retweeted
another successful H1 event with the legend @JonathanBouman, great bugs and gaining lots of new insights for future hunts! :)
that's me done with hacking now til september, getting married in 2 weeks so i'm going afk to chill :D
happy hacking, go get them crits✌️
that's me done with hacking now til september, getting married in 2 weeks so i'm going afk to chill :D
happy hacking, go get them crits✌️
43
2
352
16,255
Jonathan Bouman retweeted
@mbrg0 Open source alternative with confirmed bug bounties
Code: github.com/aliasrobotics/…
Paper: arxiv.org/abs/2504.06017
Code: github.com/aliasrobotics/…
Paper: arxiv.org/abs/2504.06017
1
25
115
11,280