This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
Access ControlInfo DisclosureInstagram$30k5y ago
Broken access control exposing private posts and stories — $30,000.
Mayur Fartade · Medium ↗The ledger
Bounty writeups.
Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.
44 writeups · $585.5k in bounties · checked today
A Facebook bug that exposes email/phone number to your friends
Info DisclosureFacebook$18.3k5y ago
Friends-only data leaks any user's email and phone — simple, elegant, paid big.
Saugat Pokharel · Medium ↗Contact Point Deanonymization Vulnerability
Info DisclosureFacebook$12k4y ago
Deanonymization — tying hidden contact points back to real identities.
Lokesh Kumar · Medium ↗How I could view any Facebook Groups Notes media
Access ControlInfo DisclosureFacebook$10k3y ago
Reading media from any Group's Notes — private content behind a missing check.
Raja Sudhakar · InfoSec Write-ups ↗How I was able to reveal page admin of almost any page on Facebook
Info DisclosureFacebook$4.5k4y ago
Revealing the admin of almost any Facebook Page through profile artifacts.
Sudip Shah · Medium ↗Privacy Disclosure on Facebook Lite
Info DisclosureFacebook Lite$4.4k4y ago
Privacy disclosure on Facebook Lite exposing user info across accounts.
RheyJuls · Medium ↗How this team accidentally found a SSRF in Slack exposing AWS credentials — $4000
SSRFInfo DisclosureSlack$4k4y ago
SSRF in a complex library exposing AWS keys — impact framing done right.
Roberto · InfoSec Write-ups ↗How I Earned $4000+ from a Simple Information Disclosure Bug
Info Disclosureprogram unnamed$4k2y ago
Low-hanging fruit done right — impact writing that turned a small bug into $4k.
Raja Uzair Abdullah · Cybersecurity Write-ups ↗Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text
SSRFInfo DisclosureCafebazaar$2.5k6y ago
SSRF into a Zimbra mail instance → full credential dump.
Yasho · InfoSec Write-ups ↗Account takeover worth $1000
Account TakeoverInfo Disclosureprogram unnamed$1k4y ago
Email-verification flow abuse leading to full account takeover.
Faique · InfoSec Write-ups ↗API Hacking: How I Stole 5000 OAuth Tokens & Won $300
Info Disclosureprogram unnamed$3001y ago
Unprotected Firebase database leaking OAuth tokens — full API-hacking series.
Aman Sharma · InfoSec Write-ups ↗Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.