Articles Writeups CVE Programs

Sign in Start free

BUGFLARE

Threat intelligence and bug bounty research platform. Live vulnerability data, in-app writeup reading, and program tracking — aggregated from trusted public sources.

Explore

Articles Writeups CVE Programs Create account

Legal

© 2026 Bugflare. Publishers retain authorship; always verify on the source.

bugflare.site

Weekly Beginner / Newbie Q&A · Bugflare

In-app reader

Weekly Beginner / Newbie Q&A

r/bugbountyAugust 13, 2026Sign in to save

Sign in to like · 0

bug-bounty community article

Could not extract a complete article body from this publisher.

Open the publisher link from the Source section below for the full article.

Source

Originally published by r/bugbounty (reddit.com).

Shown in Bugflare for convenience. Ownership and accuracy remain with the original publisher — always verify on the source when it matters.

Open original on reddit.com →https://www.reddit.com/r/bugbounty/comments/1vnd60m/weekly_beginner_newbie_qa

Discussion

Comments

Sign in to join the discussion.

No comments yet — start the thread.

Keep reading

More on Bugflare

WriteupDesktop App Local API IDOR: Hunting Bindings on LocalhostFind IDOR and auth gaps on desktop local HTTP APIs—predictable ports, missing bind checks, and cross-user object access from browser-origin calls.
WriteupElectron App RCE in Bug Bounty: Practical Hunting PathsFind Electron remote code execution via nodeIntegration, preload leaks, open redirects into shell opens, and IPC trust bugs without trashing the tester machine.
WriteupBrowser Extension Privilege Abuse in Bug Bounty ProgramsHunt extension bugs from overbroad permissions, message-passing gaps, and web-accessible resources that turn a helper add-on into account or session abuse.
WriteupMCP Server Security Testing for Bug Bounty HuntersTest Model Context Protocol servers for tool overreach, auth gaps, path traversal in resources, and prompt-driven abuse without wrecking shared environments.
WriteupRAG Poisoning Bug Bounty Basics: What to Prove and What to Skip

Learn practical RAG poisoning tests for bounty: poison documents you control, prove retrieval influence, and avoid noisy claims without a grounded impact path.

WriteupLLM Output Handling: XSS and IDOR Paths Hunters Should TestTest how apps render model output and tool results—stored XSS in chat UIs, unsafe HTML, and IDOR when prompts or transcripts ignore object ownership.

Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.