Bug bounty & VDP platform trusted by the world’s largest organisations! 🌍
Joined May 2016
- Tweets16.3K
- Following673
- Followers218K
- Likes21.2K
Intigriti retweeted
This is by far the Best Write-up on DOM-XSS by @intigriti
intigriti.com/researchers/bl…
Who's up for a bonus challenge? Possibly easier than usual! 👀
6 random solvers will win a limited edition t-shirt! 😎
Rules:
✅ Follow us @INTIGRITI
✅ Submit the flag before 02/11/2026, 11:59 PM UTC 👇
challenge-brp.challenges.int…
🔔 100 likes! That means time for the first tip!
"The first door is not on the server. The PHP side carefully wraps the name, but later the browser reads the same person value again. Ask yourself: where does text stop being 'text' and start becoming markup?"
Researchers have options. Give them a reason to choose you!
Launching a program is just the beginning; the real challenge is keeping security researchers engaged, motivated, and coming back for more. So, how can you keep your program thriving?
A successful program isn’t just about attracting researchers; it’s about creating an experience that keeps them engaged long-term by keeping it interesting and building lasting relationships.
Swipe for practical tips! 👀
Or visit intigriti.com/choose-intigri… for more information.
If you’re a security professional in the UK, this one’s for you. 🇬🇧
Hackers in the House is back in London on December 11, 2026, putting security researchers in the room with the civil servants shaping UK cyber policy.
Topics on the table include the forthcoming Cyber Security and Resilience Bill, secure-by-design practices in AI, vulnerability research, and more. No policy experience needed, the event kicks off with sessions to get you up to speed before you head into your government briefings.
And it’s completely free to attend.
More details in the link below! 👇
hackersonthehill.org/uk/
WICCON is a wrap! 💜
Two days in Haarlem with some of the most passionate people in the cybersecurity space. It was brilliant to be part of an event built around empowering women in security, and even better to meet so many of you in person. 🌟
Thank you to the WICCON team for putting together such a welcoming event, and to everyone who stopped by to say hi. See you at the next one! 🤠
#WICCON #WomenInCybersecurity
Asking your AI agent to summarize a web page shouldn’t leak your one-time password. With indirect prompt injection, it can. 😈
Hidden instructions in content an AI agent reads, like an email, a web page, or even a Reddit comment, can trick it into leaking sensitive data using access it already has. Brave’s research on Perplexity Comet showed exactly that.
Swipe to learn more about indirect LLM prompt injections. 🎃
Have you found prompt injections in AI features before? Share your story in the comments! 👇
#bugbounty #HackWithIntigriti #AISecurity
Learn more about exploiting LLM prompt injection vulnerabilities! 👇
intigriti.com/researchers/bl…
Latest Bug Bytes is live! 🚀
This month's issue is as usual packed with bug bounty tips:
✅ A full Microsoft Edge exploit chain using only logic bugs
✅ 1-click RCE in Discord via Twitch embed
✅ $250K Chrome full-chain bounty in just 6 days
✅ XSS in Cloudflare's image endpoint via SVG sanitizer bypass
+ company updates & much more! 😎
Head over to our blog to read the latest issue! 👇
intigriti.com/researchers/bl…
Want to receive your copy in your inbox each month? 😎 Subscribe to Bug Bytes now! 👇
newsletter.intigriti.com
Got a bug in an EOL product collecting dust? The Junkyard wants it. 🗑️
DistrictCon’s vulnerability research competition is open for Year 2. Find a bug in any deprecated or end-of-life software/hardware, disclose it responsibly, and present it on stage.
Prizes range from $100 to $5,000, with categories for most impactful system, best meme target, and most engaging presentation.
Final submissions deadline: December 9, 2026!
Submit your bug 👇
districtcon.org/junkyard
5️⃣ Reading RFCs for Bug Bounty Hunters
EdOverflow explains how to use RFC specifications as a research tool. The core approach: find the RFC for the technology you are testing, go straight to the Security Considerations section, and look for where the implementation deviates from the spec.
🔗 edoverflow.com/2022/reading-…
That was it! We hope you've learned something new (and enjoyed) this thread!
If you have enjoyed this thread:
1. Follow us @INTIGRITI for more of these threads! 🐛
2. Retweet the first Tweet to share it with your friends 💙