Public Bug Bounty Programs remain a rich source of vulnerabilities even after the hardening of scopes via pentests and private programs.

That’s one message conveyed by rising hacking talent ‘

’ in the Q&A below, where she offers other valuable advice to aspiring and inexperienced hackers, recounts her Bug Bounty journey so far and discusses her favourite hacking tools and bug discovery so far.

Currently ranked 49th overall, pwnii – aka 

 – has steadily ascended the YesWeHack leaderboard since joining the platform in 2022, and is already sufficiently well regarded to be invited to various live hacking events. The French hunter currently combines Bug Bounty hunting with studying for a cybersecurity degree and a part-time position as security researcher at YesWeHack. In the latter role, she presents a video series called 

, where she outlines solutions to YesWeHack’s Dojo CTF challenges.

I started to get interested in cybersecurity when I was young. I got my first computer at nine and I started to use Linux at 14. By this way, I started to get interested in CTFs. I got into a CTF team called Flag Poisoning.

I started Bug Bounty last year at leHACK. I met some people that did Bug Bounty live events, and I started to hunt at this event. I didn’t find any bugs, but when I came home I started to hunt by myself, and now I’m here!

My favourite bug isn’t a technical one. My favourite bug is an 

, but I really appreciate this one because I got it when I started to hunt on mobile applications. With this IDOR, I got the possibility to modify the email of every user. So this way I had the possibility to take over their accounts.

I found this bug pretty quickly, honestly. I got a lot of ‘flex’, and it’s especially because people mainly don’t think to go on mobile applications, or just don’t dig enough.

I’m not using that many tools. My basic starter pack is Burp Suite with PwnFox. I really enjoy using tools like Wayback Machine, Waybackurls, those kinds of things.

Using Wayback Machine or tools like that is a little trick I really enjoy, because sometimes you can find some old endpoints or just like hidden endpoints, and it can be interesting. I had the possibility, for example, to find all the source code of a platform this way.

On the three words that best describe her as a hacker…

Passionate, motivated and creative. And by creative I mean that, sometimes, with the context of your bugs, you can increase the impact. So it can be nice.

On the hacking skill she most wants to develop…

I want to go deeper into mobile applications. I’m still a newbie and I really want to go deeper in web too. I mean, I have learned a lot with Bug Bounty – but I want to go deeper again.

On her career and life plans in Bug Bounty and beyond…

I plan after my studies to maybe do Bug Bounty full-time. I will enjoy travelling around the world for a few months or maybe a year, I don’t know. I would also really enjoy opening my own company in the future.

On the most challenging aspect of Bug Bounty…

One of the hardest sides of Bug Bounty is the fact that you have to admit that, sometimes, you just can’t find bugs and it’s just normal. And yeah, sometimes it’s pretty hard to deal with duplicates. But don’t forget that a duplicate bug is a valid bug. So it’s nice!

Her top tips for newbie Bug Bounty hunters…

As a new hunter, I will tell you to be patient and just be motivated. At the beginning, it’s completely normal to not find any bugs. You have the luck on YesWeHack to have 

, so just do Dojo, and after that you will probably get some private program invites. Don’t be scared to go on public programs too. There are a lot of bugs.

Learn more about hunting through YesWeHack

, or learn about the latest hacking tools and techniques 

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

Ranked 22nd on YesWeHack's all-time leaderboard, 

 proves you can excel with the bare minimum of tools (he generally uses only one).

The French security researcher and CTF player with the 

, who has found more than 200 vulnerabilities since registering on YesWeHack in 2016, sat down with YesWeHack at leHACK this year to discuss his Bug Bounty career to date.

Among other things, he talks about how he got into hacking via video games, his fondness for PHP targets and why bug hunting is comparable to being a scientist.

Blaklis on how he became an ethical hacker…

I've been doing Bug Bounty for about seven years now. I've been hacking for much longer: I started when I was about 13/14 (to cheat on video games – it's not very glorious I know, but you have to start somewhere).

So I started Bug Bounty with my internet service provider in Switzerland, 6/7 years ago, which had decided to do a Bug Bounty almost overnight. And then eventually, I really fell into the pot of magic potion that is Bug Bounty, and then I continued to do it on different platforms.

And now I'm trying to talk about it a lot in France. I've created a community, I've done quite a few things for Bug Bounty in France. And now I've been making a living out of it for two years. So that's all I do now – I'm a full-time bug hunter.

Personally, I love hacking in general. I'm so curious that I like to go and see how everything functions, how it works, how you can make things deviate a bit from their basic functioning. And I think it's essentially about curiosity. And I also like tinkering. It's a bit like the cheating I used to do, which is still a bit present here, but now it's more for a good cause.

On what a typical day looks like as a full-time bug hunter…

Well, in reality, in a standard day for me, it starts with waking up and knowing: am I going to work or am I not going to work? I'm lucky to have this freedom.

I'm a big fan of video games, so my days are split between potentially playing video games, spending a bit of time with my partner and working – sometimes I have to! But I don’t always work on the same devices, so I can hack on my computer from the living room, or hack on completely different devices if I'm testing very specific ones. So my days aren't really standard, after all.

On the ethical hacking opportunities available in video games…

There are some. There are video games – MMORPGs, that sort of thing – that allow testing. Today, I'm just starting to get into it, very slowly. It reminds me a bit of my younger days. Today, it's more difficult than it was. There are skills I'm missing that I'm in the process of relearning. It's also one of the strengths of Bug Bounty that I now have time to learn things that I potentially lacked back then. It's time I can take for myself, to teach myself.

On the most challenging parts of being a hacker…

For me, there's no doubt about it: the most difficult aspect is the biases you can have at the beginning. When a hunter starts out, he's bound to have biases that are gigantic: ‘I'm not skilled enough to take on big companies’, ‘there are already too many people who've tested before me’ or ‘I've spent three days hacking, I've found nothing, I'm never going to find anything’.

These are things that I think we've all encountered. And it's extremely difficult to get out of them.

On the vulnerability he is most proud of…

So there are lots of bugs I'm really proud of. I like bugs that are a bit devious, a bit complex.

And here's a good example: I have a very long chain that took me a month to find on a program and it earned me a $75,000 bounty. So that's something I'm really proud of; I spent a month working on it non-stop. I cried a bit, I sweated, I had a few tears of joy when I finally succeeded too.

I don't really have a preference. It's all very subjective. I can't quite explain it to myself yet. But I just have to have fun with it. I can't explain it completely. But it's true that when I see PHP on targets, it always puts little stars in my eyes. It's a language where I know there are a lot of pitfalls. I know them very, very well: I'm a former PHP developer, so obviously I know the pitfalls quite well.

On the three words that best describe him as a hacker…

The first is perseverance: I've already talked about that, so there's really no need to explain it. The second is twisted: I like bugs that are really twisted, that are really complex, where you have to untangle a lot of things. And the third is technical: I love anything technical. And I think that I've been able to develop a technical level that's quite high today. So I think those three words represent me pretty well.

Burp. It's the only one I use. A console, Burp, a browser – and that's it, I'm off! I don't use anything else. I'm still a bit of a Cro-Magnon in the way I hack. If I need a tool, I just code it and that's it.

On the profession (not including IT or security-related jobs) that Bug Bounty is most similar to…

For me, it's pretty close to being a scientist. I like finding new things, I like always trying to push my research a little further to find new ways of exploiting bugs, new ways of exploiting mechanisms that seem vulnerable to me, that aren't at first sight but that will eventually become so.

So I'm a bit like a scientist doing research. If I had an outside view of myself, that's more or less how I see myself.

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

Soft skills and the right mindset are even more important to success in Bug Bounty than technical skills because the latter are easier to learn, according to one of Italy’s most prolific hunters.

Having first registered on YesWeHack in 2021, ‘

’ – aka Simone Paganessi – has climbed to 8th position on YesWeHack’s 

. He has notched 656 reports at the time of writing. All this was achieved while working for an Italian company as a pentester.

In the Q&A and video below, Drak3hft7 also discusses his journey to being a hacker, his best bug find so far and his favourite hacking tools.

Drak3hft7 on the challenging road to becoming a hacker…

I had a long journey. I studied [many] hours [on] software development and networks[s]. After this, I studied [for the] OSCP certification.

I started Bug Bounty three years ago. The road for a hacker is very difficult, because today it’s one technical system; tomorrow it’s a new technical system, new firmware and other updates.

I prefer YesWeHack because it’s a very fantastic structure and very fast triage. I hacked [many] companies, big companies [through] YesWeHack – it’s always exciting.

My favourite critical find is an IDOR. I was able to change the parameter in the cookie and read and edit all user data in the web application: thousands of data [points]. I reported on YesWeHack. After two or three days, it was accepted.

On the personal attributes that most fuel his bug-hunting success…

My best skill for me is persistence – not technical skills but soft skills. Because, if you are a hacker, you are persistent. Very persistent, curious, passionate. The technical skills you can study, you can try [to learn].

I prefer the proxy to analyse the request and the response, to find vulnerabilities in parameters, cookies. And [I often use] Ghauri. Ghauri is the best tool for SQL injection. And the best for me is the Wayback Machine, for getting all the requests.And the best for me is the Wayback Machine [to hunt for bugs via archived URLs].

In Italy, I love the gym – very important for physical and mental health, and stability! I love to read books and watch films at the cinema.

On whether his family and friends understand what hacking is…

My family is a big help for my hacking, because it’s very important for my stability.

My friends don’t know about my hacking skills. My family don’t understand my work in the hacking system and Bug Bounty. Always questions: “What is Bug Bounty?” – it’s a difficult answer for this question.

On his favourite hacking-related art or entertainment…

My favourite TV series is Mr. Robot. [Elliot] Alderson is a very fantastic hacker and the hacker culture in the TV series is the best.

‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far

Collaborating with ethical hackers whose skills complement his own has apparently been pivotal to the success of ‘Nagli’, one of the biggest earners in the world of 

In just a few years of bug hunting, the 26-year-old hacker has achieved more than simply racking up points and bounties from a steady stream of impressive vulnerabilities.

 – has also harnessed automation creatively to scale up vulnerability discovery, and leveraged his Bug Bounty experience in bootstrapping 

, currently also works at Wiz, the cloud security platform.

In the following interview, Nagli additionally recounts how he became a hacker, details his most memorable bug discovery, and offers several golden tips to peers with designs on emulating his success.

I was always into computers and video games – Counter-Strike, Combat Arms, MapleStory and so on… So I was always technical with computers and the field of hacking was always interesting when you play video games and see people gain advantage in an unwanted way, and do those kinds of other things.

So it was always an interesting world. When you’re a hacker you have some superpower… you can do stuff that other people can’t, and you can actually make an impact and conduct some amazing things. So that’s what I’m doing with hacking and that’s what got me to actually explore it a few years ago.

On the secrets of his bug-hunting success…

I think what helped me to become successful is a lot of collaboration, networking with other people. I got the insight that I can’t be the best hacker on every section – like hacking Salesforce products or hacking other components – so just find a lot of people who are experts in what they do and give a lot of dedication. Then, whenever you stumble on a lead, you can just pass it to them and you can explore it with them together.

But basically: just a lot of dedication, not giving up and just constantly looking, investing a lot of hours into finding bugs.

So I had a lot of interesting and pretty critical bugs. It can be code executions… but the one I most like was a few weeks ago, on my birthday actually: there was one portal that suddenly became alive and there was tons of production data of a company – like years of development, internal communications… it’s very hard to configure all your SaaS products to make sure they are always configured to have authentication, to have a login panel.

So, every time you have a bug, it allows you to see the PII of customers, of a lot of customers, so every customer of a company; or just to see a lot of internal discussions from the past. It’s a goldmine for attackers so it’s a good thing on your side to report it to the company.

On the importance of staying abreast of fast-evolving tech and techniques…

So we need to evolve and learn for every new technology, like 

, which was introduced a few years ago, APIs, nowadays AI hacking as well. So if you don’t stay on top of the latest trends, latest methodologies, you won’t make it to the top and you won’t be able to do it successfully for a lot of time. So, every time there’s a new technique or new methodology in the manual hacking space or automation, I just like to adapt it as soon as I can into my systems.

On the most productive scopes right now…

A lot of the automation bugs I saw that were very active like one year or two years ago are getting fixed. Like a lot of subdomains takeovers, like on Heroku or Route 53.

Eventually the vendors rolled them out, so you can’t only rely on vendors that have a misconfiguration and use it for your favour so… I think hacking is very valuable if you have credentials, so inside to an inner system, because then it’s constantly evolving, it’s different developers from different companies who don’t know all the security nuances, and then you can find goldmines there.

So definitely focus on manual sides, on companies, getting credentials, getting access, and then, yeah, going deep into the targets.

On founding and running his own SaaS company…

So one year and a half ago, I took my hacking side of automation, which is what I do mostly – automation and participating in live hacking events – into an actual business, a SaaS product. I saw my own vision into a product to help companies as well. It’s called Shockwave, my company.

There’s a lot of other stuff you need to learn, from being a technical hacker to being a businessman. You need to do a lot of sales calls, legal, contracts… it’s pretty challenging but it’s also fun to do and explore.

I’m very much a soccer/football fan. Arsenal is the team I’ve liked for many years. So this season we have a very good season. Watching Netflix shows, playing FIFA [football video game] with friends… so basically around soccer/football/friends is a lot of stuff that I like to do outside of hacking. Also hitting the gym and just maintaining a healthy lifestyle.

His advice for inexperienced Bug Bounty hunters…

My top tip will definitely be: follow everyone on Twitter, ask them questions – like if someone is making a Twitter thread and you don’t understand something, ask him a question.

It’s good to be curious for insights and look for products that you have extra authentication or extra privileges for – like if your bank has a Bug Bounty Program, so you have a privileged account that is not that easy to create, you have an advantage over the other hackers and you could use it to your favour.

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

Our latest ethical hacker roundup leads with a 

new open source tool for understanding how browsers parse HTML

 and uncovering mutated XSS vulnerabilities. 🛠️ The handiwork of our resident security researcher, 

, Dom-Explorer incorporates popular HTML sanitizers Ammonia, Angular, DomPurify, JsXss and SafeValues, while supported parsers include DomParser, Parse5, srcdocParser and TemplateParser. “By using this tool, you can generate this weird behaviour where if your input is not valid, it will change to something that might indicate the potential for vulnerabilities,” says Bitk. The researcher believes Dom-Explorer can simplify, accelerate and send in fresh directions this niche area of security research. 🔥

A client-side exploit chain across various Google services has impressed the InfoSec world. Leveraging Google Slides’ YouTube embed feature to access a victim’s Google Drive file, path traversal, open redirects across YouTube subdomains and oddities in Google Docs’ sharing UI, the discovery has 

netted security researcher Lyra/’Rebane’ an oddly specific bounty of $4,133.70.

 as an exemplar of how exploits can become “easier the longer you spend targeting a single company”, and evidence of an unusual combination of hacking skills. “Most white-hats specialize a bit, website logic shenanigans like iframes or the hardcore code analysis stuff like the link I posted for example. But not this [person, she] seems to have mastered both,” 

In other hacking tool news, ‘Cfreal’, highly respected for his PHP work, has made another significant contribution to this field with the 

, which helps ethical hackers exploit blind file read primitives in PHP. The researcher says the utility transcends most limitations undermining similar tools. 🚀

Speaking of PHP, the star of our YouTube channel’s latest hunter Q&A, Blaklis, also favours PHP targets. As well as discussing his preferred scopes, the prolific hunter, who sits 21st on our all-time leaderboard, reflects on how hacking video games introduced him to bug hunting, outlines his typical working day, and tells us which non-computing-related career he thinks most closely resembles Bug Bounty (watch the video below). 🐞 Similarly, we’ve also published a new 

, complete with related video, starring HakuPiku, in which he declares a fondness for hacking Android apps and open-source code. 📱

HakuPiku’s penchant for open source means he features on our new 

, which tracks the most successful hunters in terms of valid vulnerabilities reported to our open source programs. Top spots are currently held by calehuri, mdisec and foobar0x7 (visualised on the image below). 🏆 Hunters are further incentivised by the fact that any valid bugs reported to our open source Bug Bounty Programs will score hunters some exclusive merch, as well as the usual financial rewards. 🎁 Applicable scopes for this swag include 

’s seven public programs, which offer max €10,000 rewards: Log4j, Systemd, GNOME, ntpd-rs, OpenPGP.js, Sequoia PGP and CycloneDX Rust Cargo. The swag is also available via three programs managed by Open-Xchange: 

. Incidentally, the bounty grid for PowerDNS, an open-source DNS server, was recently increased to a €8,000 maximum. 💰 🎯

As for the general leaderboard, Rabhi, Xel and pocsir currently head both the overall 

Using AFL++, afl-cov and basic custom harnesses to find a libsoup bug

Back to the research writeups: we're spotlighting research from a hunter who also stars on the aforementioned open source leaderboard. In a new blog post, 'Sigabrt' 

 in which he used AFL++, afl-cov and basic custom harnesses to find a heap overflow bug in libsoup on a YesWeHack public program, namely that of 

'Ading2210', meanwhile, has recounted how he 

 for reporting Chromium vulnerabilities that allowed for a sandbox escape from malicious browser extensions with just “a tiny bit of user interaction”.  The potential consequences were grave: “Instead of merely stealing your passwords and compromising your browser, an attacker could take control of your entire operating system,” he wrote. Eek. One redditor called it “

 I've read since The Cuckoo's Egg”. 💰

Multiple vulnerabilities in a Realtek SD card reader, meanwhile, apparently “enabled non-privileged users to leak the contents of kernel pool and kernel stack, write to arbitrary kernel memory, and, the most interesting, read and write physical memory from user mode via the DMA capability of the device”. 💻  An 

 details Realtek’s fixes for what were seemingly highly serious flaws. “If your laptop is equipped with an SD card reader, it is highly likely to be manufactured by Realtek, making it susceptible to these vulnerabilities as well,” 

Our latest white-box penetration testing guide explores 

how to debug for JavaScript vulnerabilities

. In testing a web application vulnerable to prototype pollution within a Docker container, Brumens’, another of our resident hackers, demonstrates how to debug JavaScript inside Visual Studio Code in order to track payloads throughout the code process and learn how security filters can hide vulnerabilities. Relatedly, we’ve also detailed our 

top 5 hacking tools for white-box pen testing

Exploiting trust: Weaponizing permissive CORS configurations

’, Outpost24’s Thomas Stacey reveals the results of a project initiated to answer the question: “Are we underestimating CORS vulnerabilities?”. 🤔 Possibly, it seems, given the application security auditor uncovered multiple CORS (Cross-Origin Resource Sharing) flaws affecting customers, including critical issues including user sessions. He observes that both the detection and exploitation of permissive CORS can be tricky, the latter “due to modern security controls like the “SameSite” cookie attribute, or even modern application architectures like single-page applications”. Mindful of these challenges, he sets out some tooling and methodology advice for finding vulnerabilities in CORS implementations.

Other recent writeups and InfoSec news of interest include “

 of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software”; Sonar showing how to turn a file write vulnerability in a Node.js application into RCE 

when the target’s file system is mounted as read-only

data breach involving France’s second largest internet service provider (ISP) and telephone operator

, affecting more than 19 million customers and 5.11 million IBAN numbers. 😮

Next up, Dojo news. Trick or treating might be over for another year, but our platform’s new dark mode 🖤 – 

 to coincide with the celebration – is here to stay, while our Halloween-themed monthly CTF challenge – ‘

’ – has concluded (congrats to the winners: Atlas_py, qu35t3190 and Fravoi). 👻 The current active challenge is ‘

’, open for submissions until 12 December. Elsewhere on Dojo, another new training module has dropped: 

. And finally, check out our new feature, Talkie Pwnii, a series of videos from one of our researcher enablement analysts, pwnwithlove aka pwnii! In the first video, below, pwnii shows you two alternative solutions to our latest Dojo challenge, '

', and a few technical tips and tricks. 🚀

Over the weekend, we ran a successful live Bug Bounty in Buenos Aires, Argentina.

 across two days, the live hacking event involved targets from Galicia Bank. This was the final top 3:

💉 First Blood: Damián Gambacorta aka g4mb4

💥 Best Impact: 🎩 Alan L. aka soyelmago

A huge thank you to Galicia Bank for their trust and involvement. We also want to extend our gratitude to Ekoparty and Bug Bounty Argentina for their support in making this event a resounding success. 🙏

Highlights from the Ferrero live Bug Bounty

And here is the final podium for another live Bug Bounty that took place at the end of September, with legendary sweet-packaged food brand Ferrero providing the targets:

Watch highlights from this competition, which was Italy’s 

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

Security teams are sometimes apprehensive about crowdsourcing security testing for the first time.

But initially cautious YesWeHack customers often become more ambitious – adding scopes, increasing rewards or inviting more hunters – as their concerns are assuaged, according to the head of the Bug Bounty platform’s triage team.

“Ensuring customers get clear, relevant and actionable vulnerability reports gives customers confidence in the process,” says 

, YesWeHack’s head of security analysts and researcher enablement. “This emboldens them to steadily expand the program and perhaps eventually launch a public program open to all registered and vetted hunters.”

In turn, this regular addition of new hunting opportunities keeps hunters engaged, adds Adrien, a still-active bug hunter who discovered Bug Bounty in 2017.

“In essence: happy customers equal happy hunters and vice versa. It’s a virtuous circle we strive to facilitate.”

Founded and run by ethical hackers, YesWeHack also aims to keep customers and hunters happy by handling reports swiftly and objectively, therefore enabling customers to pay rewards promptly. To sustain this approach, the in-house triage team is expanding to accommodate YesWeHack’s ongoing growth, as well as operating 24/7.

Automation as well as manpower are key as the team’s workload increases, although Adrien insists that “we cannot automate everything. We can automate some easy Proof of Concepts [PoCs], facilitate initial severity assessment, and streamline repetitive, basic triage tasks.”

Triage is conducted by full-time triagers and supervised by each customer’s dedicated customer success manager (CSM). Triagers perform the following for every report:

the finding in line with the scope, qualifying vulnerabilities and other rules

 using a CVSS calculator, in consultation with the customer

, such as root cause analysis or impact assessment

“It's like a compliance check,” says Adrien.

And if the impact demonstrated by a PoC is less than the impact reported, the triagers liaise with the researcher to try and bridge this gap with additional evidence. When the converse is true – a higher impact demonstrated – the customer is promptly notified.

The knowledge accumulated from previous findings sometimes gives triagers valuable insights that the hunter might lack. “A hunter might, for instance, send a PoC for an SSRF, and we know that in the past a similar report has been evaluated with a higher impact than initially estimated after internal checks by the program,” explains Adrien.

But while triagers sometimes make such suggestions, Adrien emphasises that clients are not obliged to follow their advice. “The triage team does not make the final decision on severity, because we can’t always know everything about the impacted asset,” he insists. “If the customer has information about the technology that we don’t, we need to trust their opinion. Severity is assessed based on our experience, the customer’s knowledge and the context of the digital asset.”

The systematic prioritisation of incoming reports is a key plank of the YesWeHack model’s success (something attested to in our 

). This is based on not just on when they are submitted, but also severity and an initial evaluation of potential real-world business impact by the triage team. “If a report is validated as truly critical, it gets triaged first,” says Adrien.

Nevertheless, the process is speedy as well as thorough regardless of severity. “YesWeHack has a first-response SLA of two business days for all reports but we’re actually achieving an average of 5-6 hours,” Adrien notes.

Triagers can also advise customers on the best course of action for out-of-scope submissions (a 

 is usually a good idea). For example, Telenor recalled in a 

 how vulnerabilities discovered in out-of-scope assets in their supply chain prompted them to alert affected suppliers, some of which went on to launch their own Bug Bounty Programs.

“The technical part of being a triager is important, but it’s not mandatory to have OSCP certification when you start for example,” says Adrien. Technical knowledge can be acquired on the job because new triagers’ assessments are doublechecked by colleagues during their first four months in the role. “So a new triager is never navigating the technical side alone,” says Adrien.

Soft skills are just as crucial. “We are intermediaries. We collaborate with both hunters and customers to address problems or complaints, respond to comments and ensure reports are as clear and accurate as possible.”

Interpreting and simplifying messages is a key part of this intermediary role: “Hackers often use different language and terminology to customers,” Adrien explains. “We explain the impact as clearly as possible to customers who might be new to Bug Bounty and not have great technical knowledge.”

The triage team keeps abreast of new vulnerabilities as technology evolves and developers become adept at preventing older bug classes like SQLi.

“In general, new bugs like large language model (LLM) injection, 

, OS binary or mobile app issues are more challenging for the triage team than classic vulnerabilities like XSS, CSRF and open redirects,” says Adrien. “When reports use new techniques, we need to understand the risks, impact and possible mitigations.”

Adrien expects to still be “triaging XSS and open redirects in five years’ time, but it’s vital for us to stay up to date with new techniques. That’s why we have an internal communication channel for sharing writeups and insights about the latest hacking techniques.” The triage chief recalls how the triage team once also “sharpened their technical skills by creating and participating in a CTF challenge”.

Hunting and triaging are increasingly automated, he acknowledges, but adds: “It’s important to keep the human brain involved in triaging to ensure the impact reflects the context, our knowledge and the customer’s knowledge.”

Also central to the efficiency of Bug Bounty Programs – and minimising customers’ workload – is the customer success management (CSM) team, which helps to continuously align scopes, bounty ranges, qualifying vulnerabilities and participating hunters with evolving customer requirements and budgets.

The CSM and triage teams have a symbiotic relationship. “The CSM team shares information that helps us do our job – for instance, if scopes are accessible via accounts with four levels of privileges,” says Adrien.

In return, “we are the eyes of the CSM team. For example, we will alert them if a scope is no longer available, or if a new API endpoint crucial to the application's operation has been forgotten and should be added to the scope.”

Moreover, triagers can help the CSM team recommend hunters with relevant skills. And if a new program is producing unremarkable reports, they might suggest “making the program rules more restrictive to really focus on impactful vulnerabilities”.

Asked for advice for CISOs navigating their first Bug Bounty Program, he highlights clear, unambiguous and timely communication with hunters. “What do you expect from the bug hunter? Keep your program description simple. If someone is on vacation and no one is available to check the report for a few days, warn the hunter. Or if you modified the CVSS, explain why you think the vulnerability is not critical in the context of your organisation.”

As for testing methodologies, he advises: “If it’s possible to provide accounts on the scope, do it, because this will help hunters and triagers to do their job.”

To conclude, what is the standout improvement in YesWeHack’s triage service during Adrien’s time at the company?

“The progress is in the process,” he says. “What started as a basic triage operation has evolved into a robust system with automation and seamless collaboration. I’m incredibly proud of how our team has grown and evolved – they've not only built an efficient process but have become trusted partners to our clients and security researchers alike.”

Interested in learning more about vulnerability triage or launching your first Bug Bounty program?

to see how YesWeHack can support and secure your digital assets!

‘Happy hunters equal happy customers and vice versa’: YesWeHack vulnerability triage chief Adrien Jeanneau on creating a virtuous Bug Bounty circle

HakuPiku’s skillset and perspectives as a 

 hunter have been shaped by his experiences as a former developer, ex-pentester and participation in capture-the-flag (CTF) competitions.

 earlier this year (video and transcript below), the Swedish ethical hacker (real name Eldar Zeynalli) reflects on his Bug Bounty career so far. He talks about how he got into hacking, compares Bug Bounty to pentesting, discusses his preference for Android apps and open-source code, revisits his most critical find so far, and explains which (non-IT related) profession bug hunting most resembles.

 is a full-time security researcher and bug hunter and finds time to also play CTFs with the 

Community

‘There are a lot of vulnerabilities on public programs’: pwnii’s Bug Bounty journey so far

‘Hacking is essentially about curiosity’: Blaklis on the art and science of Bug Bounty hunting

‘My best attribute is persistence – technical skills you can learn’: drak3hft7’s Bug Bounty story so far

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

New tool for finding mutated XSS, $20k Chromium sandbox escape, Live bug bounty results from Ekoparty – ethical hacker news roundup

‘Happy hunters equal happy customers and vice versa’: YesWeHack vulnerability triage chief Adrien Jeanneau on creating a virtuous Bug Bounty circle

‘Collaboration helped me become successful’: Nagli on becoming a world-renowned Bug Bounty hunter

‘I like Android apps and open-source code’: HakuPiku on Bug Bounty, CTFs and his favourite targets

Hacking for €10k rewards and a secure open source ecosystem: Bug Bounty opportunities from the Sovereign Tech Fund

‘Hunters’ biggest mistake? Expecting immediate results’: ‘RL’ on building a Bug Bounty career

‘I like Android apps and open-source code’: HakuPiku on Bug Bounty, CTFs and his favourite targets

‘I stay on targets for a long, long time’: Chackal and Serizao on passion, persistence and partnerships in Bug Bounty

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

‘Be curious, be persistent’: Icare on thriving as a Bug Bounty hunter

‘I stay on targets for a long, long time’: Chackal and Serizao on passion, persistence and partnerships in Bug Bounty

Products

Researchers

Resources

Company

Follow us