The ledger

Bounty writeups.

Real disclosed-bounty writeups — every entry states a real bounty, verified live against the article before it's listed. Dead links are dropped automatically.

44 writeups · $585.5k in bounties · checked today

All XSS4 IDOR5 SSRF3 SQL Injection1 RCE4 Access Control7 Account Takeover12 Info Disclosure11 CSRF1 Race Condition1 GraphQL1 Business Logic4 2FA3

SortHighest bounty Newest

How Race Condition Worth Me $1000 On YesWeHack

Race ConditionYesWeHack$1k1y ago

Rate-limit race on a private program — parallel-request methodology.

Manan Sanghvi · Medium ↗

Every bounty amount, date and link was verified against the original article before listing; articles are re-checked every 24 hours and dropped if they go offline. Content belongs to the original authors.