The ledger

Bounty writeups.

Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.

44 writeups · $585.5k in bounties · checked today

All XSS4 IDOR5 SSRF3 SQL Injection1 RCE4 Access Control7 Account Takeover12 Info Disclosure11 CSRF1 Race Condition1 GraphQL1 Business Logic4 2FA3

SortHighest bounty Newest

Facebook SMS Captcha Was Vulnerable to CSRF Attack

CSRFFacebook$18.8k4y ago

CSRF on the SMS captcha flow — a forgotten protection worth $18,750.

Lokesh Kumar · Medium ↗

Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.