Harsh Jaiswal
@rootxharsh
Co-founder and research @hacktronai | auditing at
@cure53berlin | prev @zomato @vimeo @pdiscoveryio @httpvoid0x2f
1.3K Following 25.7K Followers
I have been on both side of such submissions and sometimes people go outside scope, knowingly or unkowningly, try to show max impact in safe manner and bounties can be debated but a sincere thank you doesn't cost anything ig?
The way it was handled, in my 10 years of bug bounty exp, I had only seen it twice.
Show more
Of all the disclosures we did over the last few weeks, my favourite was working with Vercel team, they actually cared, understood the attack surface and responded quickly.
We’re disclosing HEIF Heist, a months-long investigation into libheif that allowed us to hack OpenAI, Slack, Meta, GitHub Ent, Rails, Next.js, ImageMagick, and many more.
It was literally xkcd #234#, one obscure image library beneath a huge number of apps. 🧵
Show more
