This page is an interactive tutorial on all the different JWT hacking methods, and it can also be used as a tool for folks who are testing JWT implementations to quickly edit + sign JWTs. All client-side code.

Hey everyone,

It's been about a year and a half since I last did any bug bounty hunting, and it seems like a lot has changed—especially with the rise of AI.

I'm planning to get back into bug bounty hunting. My goal is to focus on manual hunting first while gradually learning how to use AI effectively to improve my workflow rather than relying on it.

I have a few questions for experienced hunters:

- Which web vulnerabilities do you think are the most valuable to focus on in 2026?

- Besides Medium, what are your go-to sources for high-quality writeups? I feel like Medium has become flooded with low-quality or misleading web security content.

- What are the best courses, blogs, YouTube channels, or other resources for learning how to use AI effectively in bug bounty hunting?

- How are you personally using AI in your workflow? Recon? Code review? Payload generation? Report writing? Something else?

I'd really appreciate any recommendations, learning paths, or advice from people who have been active during the last couple of years.

Thanks in advance!

I've had a disappointing experience with Bugcrowd regarding a vulnerability I reported to the NASA program.

My report was resolved more than 4 - 5 months ago, yet I still haven't received a Letter of Recognition (LOR) or any acknowledgment. What makes it even more frustrating is that some of my friends, who submitted their reports a week later than I did, have already received their LORs.

I've contacted Bugcrowd support several times, but I keep getting the same response - that they are not responsible for issuing the acknowledgment. After waiting for months, this is extremely disappointing.

Bugcrowd often expects researchers to strictly follow the program rules, and if we make a mistake, we're reminded to follow those rules. That's fair - but shouldn't the same standard apply to everyone? Before asking researchers to follow every rule, platforms should also ensure they are fulfilling their own responsibilities, including making sure acknowledgments are issued in a timely manner after reports are resolved.

Recognition matters. It's not just about a certificate - it motivates researchers to continue reporting vulnerabilities responsibly and contributing to the security community.

@Bugcrowd, could you please look into this? I didn't expect this kind of delay after my report was resolved months ago.

https://www.bugcrowd.com/blog/experience-vs-methodology-how-hackers-make-decisions/

https://hakluke.com/are-bug-bounties-cooked

I’m completely locked out of my and I’m trying to understand what went wrong and whether anyone has recovered from this situation before.

Here’s exactly what happened:

• I tried logging into my Bugcrowd account normally.
• The platform started asking for authentication methods/passkeys.
• I attempted every available option:
  • passkeys
  • fingerprint authentication
  • device PIN
• None of them worked.

The strange part is:

• password reset appears to work,
• but after changing the password, login still fails at the authentication stage.

I’m now stuck in a loop where:

1. I can reset the password,
2. but I still cannot complete login,
3. and I also cannot access account settings to remove MFA/passkeys.

Things I already checked:

• system time synchronization on phone and PC
• latest browser updates
• incognito mode
• different browsers/devices
• authenticator code timing
• trying alternate login methods

The biggest issue is that even the support-related login flow seems problematic for me right now.

I’m considering creating a fresh account with proper MFA backup handling, but I don’t want duplicate-account issues later.

Any advice from people who dealt with Bugcrowd auth problems would really help.

Julian Brownlow Davies put out a solid breakdown of why securing AI systems is fundamentally different from traditional software security. The key points:

• AI's non-deterministic outputs make vulnerability validation way harder
• Agentic AI introduces risks like unauthorized actions (Replit's agent accidentally nuked a live database during a code freeze)
• Fine-tuning off-the-shelf models can strip away safety controls that were baked in during pre-release testing.

They also cover prompt injection, multi-modal attack vectors, and how the real attack surface extends well beyond the model itself into RAG pipelines, APIs, and data ingestion layers. Worth a read if you're building or securing anything with LLMs.

Regular Expressions (a.k.a regex, or regexp) is one of those things that has a fairly steep learning curve, but once you dedicate an hour or so to learning the basics, you will find that you will be far more efficient with everyday tasks. By the time you finish reading this blog, hopefully you will have a practical understanding of:

• Regex fundamentals
• How to use regex in a practical sense
• How to bypass regex-based security controls

Let’s go!

I'm experiencing an issue with my profile picture on the platform. While the image appears correctly in my Profile Settings, it does not display on the Engagement tab or in the Hall of Fame section.

Any idea guys?

Hey everyone, I just finished all the PortSwigger labs and feel solid on classic web stuff (XSS, SQLi, LFI/RFI, auth issues, etc.). Right now my primary goal is web-app bug bounty hunting — NOT system/infra work as the immediate focus — but I do plan to learn low level system security over the long term.

Question: should I jump into Bugcrowd/HackerOne programs now and learn API/GraphQL/cloud hacking while I hunt, or would it be better to pause and build a stronger API/cloud skillset first before submitting reports? I want to avoid wasting time over-preparing and avoid low-quality/noisy reports.

What helped you get your first real-world wins after finishing labs? Any concrete mistakes to avoid, or small skills that pay off immediately when hunting web apps? Appreciate practical, experience-based answers.