Bug bounty hunting insights, strategies, and experiences from a full-time hunter on YesWeHack, HackerOne, and Intigriti.
Finding vulnerabilities has never been easier with AI, exciting and terrifying at once. This week: the relentless pace of always needing the latest tool, why I keep getting duplicated on Criticals that used to be bug of the year, and the too-expensive gadget I rewrote the firmware for.
Two weeks working full-on with Codex, on the simplest setup I ever had: my server, ssh and tmux. This week: why going back to simple was the best decision I made, why I'm slowly breaking up with Claude, and the weird feeling of reporting bugs I didn't really find.
I tore down my over-engineered home lab and rebuilt it around a single tmux on a VM, the kind of setup we could have run in the 2000s. Then GPT 5.6 pulled me away from Claude for a bit. And some honest thoughts on what finding bugs feels like now that the agents do the finding.
I figured out I've been using Claude wrong: telling it to "keep going" on a loop instead of guiding it like the intern it actually is. Plus why real human contact matters more than anything in bug bounty, and a few slow days off in the Vosges.
LeHack was back at La Villette, in the middle of a heatwave, with the YesWeHack Live Event on Puma. Then something completely different: my first round table, in a room full of suits talking compliance and SOC 2. This week: LeHack, the round table, and where AI is taking hacking.
This year's hacker house: same crew, a villa in the south, and the first time we all met up since Claude landed in our lives. Now we all just point it at the scope, and we all surface the same bugs. The trip, the new hunting setup, and a whole lot of duplicates.
Two ways to use AI for bug bounty: full autonomy that drowns you in slop, or focused delegation that brings the fun back. Plus the 90 euros Claude burned on my card, and why the game still feels broken.
A week between a YouTube shoot, a hypnosis session, and thoughts on impact-driven goals in bug bounty and learning in the LLM era.
I published my bug bounty methodology this week. Plus a few thoughts on why work discipline comes and goes, and how I got pulled back into Minecraft after years away.
My article on the state of bug bounty blew up. A massive welcome to all the new readers, what to expect from this blog, and why I'm stepping back from the noise.