Bounty writeups.

Pre-auth RCE in Messenger for Windows — one of Meta's largest recorded payouts.

Self-XSS chained through the payments flow into full Instagram/Facebook ATO.

Second part of the legendary series — chaining bugs into account takeover.

Broken access control exposing private posts and stories — $30,000.

The classic: brute-forcing the password-reset rate limit to take over any account.

FXAuth token abuse turns two clicks into a full Instagram account takeover.

Full 2FA bypass on Facebook accounts — discovery through exploitation.

A stolen Datr cookie plus an AI chatbot escalates to full account takeover.

CSRF on the SMS captcha flow — a forgotten protection worth $18,750.

Friends-only data leaks any user's email and phone — simple, elegant, paid big.

Recon-to-report walkthrough of a critical IDOR on a public SaaS program.

CVE-2019-18426 — the road to remote code execution inside WhatsApp.

Deanonymization — tying hidden contact points back to real identities.

Deleting any video or Reel — a destructive action missing one authorization check.

Regression hunting: re-exploiting a 'fixed' IDOR through the fix itself.

Unprotected backup-code retrieval quietly defeats 2FA on Instagram and Meta accounts.

Reading media from any Group's Notes — private content behind a missing check.

Abusing self-hosted GitHub runners for code execution inside Meta's CI.

Trimming a stranger's private live video to reveal frames they never posted.

OAuth token leakage — a flow bug that hands out valid access tokens.

2FA bypass on a public program without ever passing the second factor.

IDOR in Campaign Planner — share links for any advertiser's campaign.

Textbook IDOR on a Reddit endpoint — clean, reproducible, $5,000.

Stored XSS on Apple Developer — persistence + escalation explained.

The legendary Protobuf-fiddling XSS — a masterclass in parameter digging.

Revealing the admin of almost any Facebook Page through profile artifacts.

Privacy disclosure on Facebook Lite exposing user info across accounts.

SSRF in a complex library exposing AWS keys — impact framing done right.

Methodical SSRF chain — one of the best-structured learning writeups.

Low-hanging fruit done right — impact writing that turned a small bug into $4k.

Abusing Call-To-Action buttons to launch internal deeplinks from the app.

Blind SQL injection through a GraphQL endpoint — $3,500 and 40 points.

Unauthorized balance top-up — a critical business-logic flaw, step by step.

RCE in the first 15 minutes of recon — where to look first.

SSRF into a Zimbra mail instance → full credential dump.

Full ATO walkthrough with the author's complete thought process.

Price-manipulation logic bug found by poking a single URL parameter.

Critical stored XSS in Shopify Core — full report included.

Rate-limit race on a private program — parallel-request methodology.

Host-header injection in password reset — cheap to test, found everywhere.

Email-verification flow abuse leading to full account takeover.

Realistic first-bounty shape: private program, modest IDOR, real payout.

OAuth account-fusion pre-takeover — a pattern worth checking on every program.

Unprotected Firebase database leaking OAuth tokens — full API-hacking series.