Joshua Rogers on his bug bounty experiences in 2025.
Positive for #curl, kafka-esque for all others mentioned. ‚BugCrowd‘ seems to a typical level-1 support company living on denials.
(Joshua also reported on Apache and pbly other projects where he could talk to the maintainers. I take #curl here as an example for FOSS projects interested in actually securing things.)
joshua.hu/2025-bug-bounty-stor…
My 2025 Bug Bounty Stories
A recap of my 2025 bug bounty experiences, featuring failures and stories from Google Cloud, GitHub, Vercel, Opera, and others.Joshua Rogers (Joshua Rogers’ Scribbles)
Matt Campbell
in reply to Matt Campbell • • •Sensitive content
In the recent post I referred to, the author says that an LLM enables them to write an "insane" quantity of code.
Yes, I think it _is_ insane. A proficient typist can probably already type faster than most of us can read _and think_. An LLM can generate tokens way faster. So increasing the quantity of code probably isn't good for having code that's well understood and reviewed.
Mike Gorse
in reply to Matt Campbell • • •