100 Days of Bug Bounty — Day 10 🐞

Kept digging into the API from yesterday and this time actually found something, looked like a potential authorization edge case where a request seemed to go through with less restriction than expected. Solid enough that I started writing up the report right away.

Then, before hitting submit, something made me stop and go back to the scope page one more time.

Good thing I did. It was intended behavior, explicitly mentioned in the program's documentation as expected functionality, not a bug at all.

After last week's out-of-scope lesson, this one felt different, this time the habit actually paid off before I wasted a submission, instead of after. That's the whole point of building the check into the process rather than treating it as a one-time lesson.

Closed the tab, kept testing.

Day 10 complete.

90 days to go.