#bounty
-
Arguing a 'Not Applicable' Verdict: A Laravel Debug Page That Leaked a Private Repo
A staging environment left Laravel debug mode on, leaking full stack traces, file paths, and a link to a private GitHub repository. The program marked it Not Applicable anyway, here's the finding, the back-and-forth, and why debug mode in production (or staging) is never really 'no impact.'
-
A Public sitemap.xml Isn't a Vulnerability, But What It Lists Might Be
A sitemap.xml disclosure report got closed as Informative, correctly, sitemap.xml is meant to be public. But the report also found a query-parameter trick that paginated through listed entries, including ones that weren't linked anywhere else. A look at where the line actually sits.
-
Arguing a 'Not Applicable' Verdict: Hardcoded Google Maps API Keys Aren't Free
A bug bounty report on a hardcoded, unrestricted Google Maps API key got marked Not Applicable, here's the technical rebuttal, the per-request cost math, and the precedent that makes this class of finding worth taking seriously.
-
Chaining a jQuery Prototype Pollution Bug with DOM XSS to Steal CSRF Tokens
How a legacy jQuery 3.2.1 dependency led to a CVSS 9.3 vulnerability chain: CVE-2019-11358 prototype pollution combined with a DOM-based XSS quirk in <option> parsing, chained to exfiltrate CSRF tokens and session cookies from an admin login page.
-
When Username Enumeration Isn't a Vulnerability
A username enumeration report against a public course platform got marked Not Applicable for a simple reason: the usernames were never private to begin with. A look at why context decides whether enumeration is a real bug.