What the hunts find, in public.
Advisories from live bug-bounty programs, a ranked feed of exploited CVEs, security fixes for the frameworks web apps are built on, and the write-ups behind them.
- advisoriesFindings from live bug-bounty programsNumbered and severity-rated, each validated with a working PoC. Titles stay redacted until the program discloses.18 findings · 9 programs · since Aug 2026
- threat feedExploited CVEs, ranked by what to patch firstCISA's Known Exploited Vulnerabilities catalog with FIRST EPSS, one page per CVE.8 added this week · 39 labelled patch now
- security changelogSecurity fixes for Next.js, Nuxt, Astro and ViteAffected ranges, fixed versions and CVEs from the GitHub Advisory Database, without the release-note noise.pulled hourly
- write-upsHow the hunts work and what they showLong-form posts on proof, retests and signed evidence.3 posts
Write-ups
- A finding without an exploit is a rumorAI made candidate vulnerabilities almost free, for defenders and attackers alike. What is scarce now is proof that a bug is real, reachable and in scope.Oct 26, 2026
- Patched vs proven patchedA fix shipping is one claim. The bug being gone is another. Only the second gives an auditor something to check: a replayed attack with a date on it.Oct 24, 2026
- What's in a signed security reportEvery engagement ends in a signed, dated report. Here is the shape of the evidence, from scope to retest, using the public sample.Sep 20, 2026