This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
Access ControlInfo DisclosureInstagram$30k5y ago
Broken access control exposing private posts and stories — $30,000.
Mayur Fartade · Medium ↗The ledger
Bounty writeups.
Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.
44 writeups · $585.5k in bounties · checked today
I Found a Critical Vulnerability — They Paid Me $15,500
IDORAccess Controlprogram unnamed$15.5k5mo ago
Recon-to-report walkthrough of a critical IDOR on a public SaaS program.
cyber security · Medium ↗Delete any Video or Reel on Facebook (11,250$)
Access ControlFacebook$11.3k4y ago
Deleting any video or Reel — a destructive action missing one authorization check.
Bassem Bazzoun · bugreader.com ↗Bank offer IDOR Fix Bypassed — a $10,000 Bounty
IDORAccess Controlprogram unnamed$10k1y ago
Regression hunting: re-exploiting a 'fixed' IDOR through the fix itself.
bombon · Medium ↗How I could view any Facebook Groups Notes media
Access ControlInfo DisclosureFacebook$10k3y ago
Reading media from any Group's Notes — private content behind a missing check.
Raja Sudhakar · InfoSec Write-ups ↗Trim private live videos and access them
Access ControlFacebook$7.5k4y ago
Trimming a stranger's private live video to reveal frames they never posted.
yaala · Medium ↗Caught an IDOR Vulnerability on a Private Program — Earned a $600 Bounty
IDORAccess Controlprogram unnamed$6001y ago
Realistic first-bounty shape: private program, modest IDOR, real payout.
Tanishx0h · Cybersecurity Write-ups ↗Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.