Web2/2.5/3 bugs. Mostly the ones auditors skip. rmrf.tips
Joined April 2026
- Tweets 11
- Following 13
- Followers 327
- Likes 40
2 Photos and videos
May 1
Whitehat: "maybe just responsibly disclose after all?"
Google: sure! memory corruption ā $500, controlled write ā $5k.
And it's not enough to just find the bug ā the PoC has to land as the right files, no harness/shell scripts/CDP, with a flawless repro on their end.
The industry itself is handing wavering whitehats a one-way ticket to "enjoy cybercrime."
š£š¢ Calling all Android and Chrome bug hunters š§āš»š!
We're updating our Android & Chrome VRP programs to ensure we can continue to reward the most challenging and impactful vulnerabilities researchers find in our products. For details, š
bughunters.google.com/blog/eā¦
229
Apr 24
Just paid $240 for ChatGPT Pro after @xbow called GPT-5.5 "Mythos-like hacking, open to all".
Passed KYC on chatgpt.com/cyber. Asked Codex to deploy OpenClaw (a standard gateway utility) on infra I rent.
Result: account flagged for "high-risk cyber activity", requests throttled.
Not a pentest. Not an exploit. A deployment task.
@OpenAI @xbow what exactly is "open to all" here? cc @psawers
2
4
733
Apr 21
Every JWT writeup online covers 2ā3 attacks and stops.
I got tired of jumping between 40 blog posts, so I wrote the whole thing. All in one place.
rmrf.tips/en
#infosec #appsec #bugbounty #websec #jwt
11
267
1,177
77,336