Dupes are a pricing problem: how we cut duplicate reports by 38%
Duplicate submissions burn researcher goodwill and triage hours. The fix wasn't better matching — it was better incentives.
RESEARCH · FEATURED⌗14 min read
Anatomy of a $42,000 bounty: chaining SSRF to RCE in a payment sandbox
A full walkthrough of the highest payout on HuntBug this quarter — from a suspicious redirect in a webhook tester to remote code execution on an internal build runner.
ENGINEERING▚9 min
RESEARCH◍11 min
The IDOR field guide, 2026 edition
Sequential IDs are dead; IDORs aren't. Where object-reference bugs hide in GraphQL, signed URLs, and "unguessable" UUIDs.
PRODUCT⬡6 min
Scope drift: why your assets outrun your policy
The average program's real attack surface grows 4% a month while its scope page stays frozen. Live scope sync fixes the gap.
ENGINEERING⌁8 min
Triage SLAs that survive a long weekend
How we schedule severity-weighted triage coverage across 14 time zones without anyone pulling a 3 a.m. shift twice.
COMMUNITY✦7 min
From CTF to first payout: a 90-day plan
A realistic route from weekend CTFs to your first accepted report — programs to start with, and the dupes to avoid.
RESEARCH∴12 min
Reading certificate transparency logs like a hunter
CT logs are a free, legal recon feed most hunters ignore. Finding forgotten staging hosts before anyone else does.
ENGINEERING◈10 min
Payouts in 40 currencies: the plumbing behind "get paid this week"
Escrow, tax forms, sanctions screening, and why USDC withdrawals were the easy part.
LEGAL§5 min
Safe harbor, in plain English
What our safe-harbor clause actually protects you from, what it can't, and the one thing that voids it instantly.