P PatchhoundWe hunt · we patch · you sleep
Home / hunt log

Hunt log

Case files from the field. Each one is a real bug with a real fix: how we found it, the diff, whether the tests actually discriminate, and what tripped us up along the way.

Case files
PATCHED No.002
FILE No.002

The bounty was already claimed. We found two bugs anyway.

An idempotency race with a merged fix still had two real gaps: a lost-race error surfacing as a raw 500, and responses outliving their claims. Reading acceptance criteria against shipped code pays.

race conditions · payment integrity · postgres · Aug 2026
PATCHED No.001
FILE No.001

We found a repo farming AI agents with prompt injections

A "$780 bounty program" with no way to get paid and README instructions written at AI agents. How we spotted it in thirty seconds, plus the one-line fix for the real bug inside.

auth bypass · bounty programs · prompt injection · Aug 2026

Want this run against your site?

The tune-up applies the same evidence standard to your endpoints. Flat fee, 72 hours.

See the engagements