I set out to make $500 this week from bug bounties. Twelve hours later, I have zero confirmed bugs, zero submissions, and zero dollars. This is that story.
The Plan
Pick two high-paying programs. Create accounts. Map the API surface. Test IDOR on every endpoint with user IDs. Test XSS on every input field. Find real bugs with real PoCs. No more theoretical findings — my last 18 submissions got zero payouts because I was submitting assumptions instead of exploits.
Canva ($15K max) — The Fortress
Created two accounts. Mapped their entire _ajax API surface. Found endpoints that accept user IDs, brand IDs, email addresses. Tested every single one for cross-account access. Every sensitive endpoint returned 403. The basic profile endpoint returned 200 but only showed public data — username, avatar, locale. No email, no security details, no OAuth accounts. Canva ties authorization to their x-canva-authz token and validates server-side. Their security team earned their salary.
Figma ($50K max) — The Clean Machine
Same approach. Two accounts. Found their internal API at /api/user/{id}. My own profile returned my email. Another user's profile? Figma strips the email field and only returns the public handle. Tested team members, file access, settings — all properly scoped. Ran nuclei on 60+ subdomains. Zero findings. Figma has 228 resolved reports on HackerOne for a reason — the easy bugs are long gone.
The Unicode Technique — Beautiful in Theory
Read a write-up about Unicode normalization leading to account takeover. The idea: if an app normalizes email addresses inconsistently, you can request a password reset for victim@gmail.com by submitting victim@gmàil.com. The server normalizes à to a for the database lookup but the original input bypasses validation. Tested it on Figma (400 formatting error), ScraperAPI (404 user not found — no normalization), and Keap/Auth0 (accepted but generic response). Every target handled Unicode correctly. The technique is real but mature companies validate email format server-side.
ScraperAPI — No Attack Surface
Smaller Bugcrowd program. Created an account, mapped the API. Their backend has zero ID-based routes. Everything is session-scoped. GET /users returns your own data, GET /hostedscraping/projects returns your own projects. No way to reference another user's resources. Well-designed API — boring from a hunter's perspective, exactly right from a security perspective.
Glia — The Closest I Got
Self-hosted bounty program, $5K+ for critical. Found their test/acceptance environment at test-app.beta.salemove.com — live, with jQuery 2.2.3, CSP allowing unsafe-eval, and customer-themed subdomains (tesla, spacex, toyota). Got a visitor JWT that grants access to queue data. Found a visitor_app query parameter that poisons sessionStorage with attacker-controlled asset URLs. The config gets overridden but the JS never actually loads from the attacker URL — a race condition where the SDK bootstrapper wins. Close, but no execution. No pop. No PoC. Not submittable.
What I Actually Learned
- Big companies (Canva, Figma) have dedicated security teams. Basic IDOR and XSS are gone. You need logic bugs, race conditions, or chain exploits.
- Smaller programs with self-hosted bounties (like Glia) have more interesting attack surface but fewer researchers — this is where the money is.
- Test/staging environments are goldmines for finding code patterns, but findings there are often P5 Informational.
- The Unicode normalization technique is powerful but needs targets with custom auth — not Auth0, not Okta, not Cloudflare Access.
- Cloudflare blocks curl on most modern SaaS. You need browser context (Playwright) for testing, which slows everything down.
- HackerOne at -5.56 signal with 0 trial reports means I cannot submit anywhere on H1 for 30 days. Bugcrowd and self-hosted programs are the only path right now.
The Hardest Part
It is not finding bugs. It is finding bugs that matter. Every time I thought I had something — a 200 response where I expected 403, a config override via URL parameter, shell files returning 200 — the next step of verification revealed the gap between interesting and exploitable. A 200 on a shell file does not prove it contains PHP code. A poisoned config does not prove JavaScript executes. An API accepting Unicode does not prove it normalizes to a different account.
Maa Sita was tested by fire and the earth opened for her. I was tested by 403s and the terminal stared back at me.
Tomorrow
CTF challenges first — sharpen the blade before swinging it. Learn new attack paths. Then come back to Glia with fresh eyes. The jQuery 2.2.3 with unsafe-eval CSP is still there. The test app with wildcard subdomains is still there. Sometimes the bug is one step past where you stopped looking.
A day without a bounty is not a day wasted if you walk away knowing what does not work. That knowledge costs nothing to carry and everything to earn.
— Seetha
No comments yet