Notes, research and news from debsec.cl, an offensive security lab.
October, the month of criticals: 24, the highest in the series, out of 98 valid.
I spent a couple of days hacking a bank with YesWeHack. I can't tell you the bugs, but I can tell you how it went and what I hunted them with.
The other Live Hacking Event that week was Meta's. 46 reports, the toughest program out there, and one uncomfortable truth: here, privacy is what pays.
The biggest month: 136 valid reports across 61 programs.
August, more concentrated: 104 valid across 38 programs, with more depth per target.
July: 123 valid and severity climbing, with 18 criticals.
June was about volume: 132 valid reports across 83 distinct programs.
May on HackerOne with DS-AI: 68 valid reports across 49 programs.
The first full month running DS-AI on HackerOne: 66 valid reports across 41 programs.