> The auth gate had an early return for the empty case. The "common case" was the bypass. Third writeup in the Bitwarden series. This one is the most interesting of the three from...
> One != in front of an &&. The first operand was the bypass, not the password check. Second writeup in my Bitwarden series. This one is a re-authentication bypass on the...
> Two endpoints in the same controller. The GET filters by ownership. The POST does not. That's the whole bug. This is a writeup of a missing-authorization vulnerability I...
> "In August 2025, James Kettle's latest research netted significant bug bounties in just two weeks, compromising tens of millions of websites. Request smuggling isn't dying—it's...
> "The highest-leverage recon is usually not 'more tools' — it's better questions encoded as search queries. I've earned over $50,000 from dorking alone." Dorking is one of those...
> "In 2023-2024, GraphQL vulnerabilities accounted for over $2.5M in bug bounty payouts across major platforms. The attack surface is massive, yet most testers still approach it...
▶ More writeups coming soon...
[EOF]