Home / hunt log

Hunt log

Case files from the field. Each one is a real bug with a real fix: how we found it, the diff, whether the tests actually discriminate, and what tripped us up along the way.

Files
FILE No.002PATCHED

The bounty was already claimed. We found two bugs anyway.

An idempotency race with a merged fix still had two real gaps: a lost-race error surfacing as a raw 500, and responses outliving their claims. Reading acceptance criteria against shipped code pays.

race conditions · payment integrity · postgres · Aug 2026
FILE No.001PATCHED

We found a repo farming AI agents with prompt injections

A "$780 bounty program" with no way to get paid and README instructions written at AI agents. How we spotted it in thirty seconds, plus the one-line fix for the real bug inside.

auth bypass · bounty programs · prompt injection · Aug 2026

Subscribe without an inbox account: RSS feed.