r/hacking • u/Ok_Matter9038 • 2h ago
Vulnerability EVERYTHING is vulnerable
I had posted before about how easy it is to get bug bounties. How its the most underrated way to get your foot in the door. And again and again people told me no its not easy. Yes it is.
I audit a lot of repos and here's my dashboard (this is all just from last month):
To prove it I set out to find some volunteers to have their repo scanned (applause to them for being brave in letting me publicly roast their security posture).
I ran the process in a very open way so that people could see. You can audit every single one of these findings (albeit some may be fixed): https://www.reddit.com/r/vibecoding/comments/1w04gny/comment/p72mszw/?context=1&screen_view_count=2&ext-referrer=DIRECT
And here are the results:
Leaderboard
| repo | total findings | Critical | High | Medium | Low | Info |
|---|---|---|---|---|---|---|
| enve book (reddit is not letting me paste in the link. idk why) | 499 | 3 | 26 | 23 | 0 | 447 |
| https://github.com/rrhoopes3/Grok-Party-Pack | 154 | 1 | 37 | 14 | 23 | 79 |
| https://github.com/ubermuda/loupe | 77 | 0 | 14 | 10 | 13 | 40 |
| https://github.com/VIDGuide/dogwatch | 76 | 0 | 0 | 19 | 12 | 45 |
| https://github.com/homeassistant-extras/pi-hole-card | 71 | 0 | 0 | 3 | 5 | 63 |
| https://github.com/GChavez0210/NetPulse | 60 | 0 | 1 | 3 | 1 | 55 |
| https://github.com/shaqkao/screenshotify | 36 | 0 | 0 | 2 | 6 | 28 |
| ps://github.com/mencelot/DK2-Remix-Predetermined-Hashing | 28 | 0 | 0 | 1 | 0 | 27 |
| https://github.com/thecyborgcoder/2026-world-cup-simulation | 18 | 0 | 1 | 5 | 0 | 12 |
| https://github.com/ghreprimand/odytty | 13 | 0 | 2 | 3 | 1 | 7 |
| https://github.com/gtited-jpg/DaemonCore-Linux-Distro | 10 | 0 | 1 | 6 | 3 | 0 |
| ttps://github.com/KrystalUnity/krystal-loop-protocol | 8 | 8 | 8 | 1 | 0 | 7 |
| https://github.com/8exgh/meeting-alert | 6 | 0 | 0 | 0 | 5 | 1 |
What should I do next? See if I can get someone to beat the Leaderboard's high score? Give up?
edit since I should have credited them: tool used is https://swifi.ai.
7
u/HoratioWobble 1h ago
I mean what did we expect from Grok-Party-Pack
1
u/Ok_Matter9038 1h ago
At least they accepted the feedback and tried to fix.
I've had been told by others that cleatext http is by design cuz proper tls will break things...
2
u/ChameleonCRM 1h ago
Daemoncore Linux Distro still hanging in bottom 3 ( least issues ) w00t w00t
3
3
u/l__iva__l 1h ago
i guess it depends of the longevity of the software; its easier to find bugs on new programs, and AI has made it easy for low-medium severity
if you want a challenge, try to find a critical bug in windows tcp/ip stack without a specific configuration, RCE exploitable
well it doesnt need to be windows, maybe apache,nginx or litespeed
5
u/dankney 57m ago
Next, you should write fixes for the bugs you've found, or at least the critical ones.
Closing the loop on that is what drives security improvements. It's the part that many conference talks leave out -- they just fire a bug report to the maintainers and peace out.
This is open source. Testing isn't a contribution if it doesn't drive fixes.
11
u/WE_THINK_IS_COOL 1h ago
Yeah, AI has changed everything. I have hundreds maybe thousands of medium issues on my hard drive that I just don't have any time to validate and report because of all the critical/high. Everyone needs to be using AI to audit their code.