Bug hunter

Joined July 2019
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
4
61
3
241
22,425
I read OpenAI’s post about the Hugging Face incident and the JFrog bugs they found. Thought I’d try finding the full chain myself using Codex. Ended up rediscovering one of the CVEs and chaining pre-auth → admin → RCE on Artifactory. edrabb.fr/posts/full-chain-p…
2
23
1
102
9,639
July + August
7
1
90
4,825
Edra retweeted
I left my pentest job to fix what every pentester complains about: reporting and team management. 18 months building, 6 months tested on real engagements. Today it goes live. Vulnotes is officially available 🚀
It's official: Vulnotes is live 🎉 The platform for your entire pentest engagement ✍️ Visual report editor 🔁 Built-in review workflow 📤 Export to docx, pdf, csv.. 🤖 AI: screenshots → findings, translate, rewrite 🔌 API + MCP 👉 vulnotes.com
7
17
1,432
We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5. We'll begin restoring access tomorrow, and will share an update soon. We’re grateful to our users for their patience, and to everyone who worked with us on redeploying the models.
4,002
12,653
7,035
83,737
15,181,418
One Month Letting Claude Code Hunt Bugs For Me - @0xEdra edrabb.fr/posts/one-month-le…
4
26
206
13,637
Edra retweeted
Introducing Claude Fable 5: a Mythos-class model that we’ve made safe for general use. Its capabilities exceed those of any model we’ve ever made generally available.
4,915
14,128
9,951
103,478
57,683,449
Just got a reward for a high vulnerability submitted on @yeswehack -- Improper Neutralization of Input Used for LLM Prompting (CWE-1427). yeswehack.com/hunters/edra #YesWeRHackers
15
6
256
4,991
(っ◔◡◔)っ We are joining @MistralAI ! c(◔◡◔c) I’m thrilled to announce that we are merging forces with @MistralAI I am officially starting a new chapter as Cyber Ops Lead, and the best part is I’m not coming alone! I’m bringing part of the AllVei team with me to build the future of AI for Cyber :D After talking with @GuillaumeLample and the founding team, it quickly became clear that we share the exact same obsession and mindset. With Mistral, we’re scaling up to a whole new level: the innovative spirit of the French AI champion, incredible resources, and absolutely brilliant people to work with every day. The fit was just too obvious 😄 A huge thanks to Guillaume and the entire Mistral team for their trust. I also want to thank everyone who believed in AllVei over the last few months. Thank you to the incredible tech ecosystem in Brittany (Village By CA Finistère, @regionbretagne , @FTBrestPlus , @Bpifrance ), to the VCs, and to our amazing design partners. Your support meant the world ❤️ Can’t wait to show you what we’re building. Let’s get to work 🔥 𝑯𝑨𝑪𝑲 𝑻𝑯𝑬 𝑷𝑳𝑨𝑵𝑬𝑻 :𝑫
16
23
190
24,013
I've been doing bug bounty full-time for 4 years. I just published everything I know. Methodology, AI workflow, templates, prompts, report structure, and the mental side nobody talks about. It's mostly to prove to you that there is no magic tricks or payload aituglo.com/guide/bug-bounty
5
24
1
158
5,403
Q1 recap time - and our hunters checked off several Bucket List items 😎 Huge congrats to @0xEdra, hannibal813 and ap4sh for a fruitful first quarter 🔥 Swag packs are on the way! 🚨 To all our community: 6 items still unsolved… who’s next to tick one off?
2
2
19
1,747
I'm happy to release the first version of my DOMLogger++ plugin for @CaidoIO! 🔎 It improves the browser extension in several ways: • Persistent, per-project storage • Temporary session recording • AI support • Stack trace reconstitution • ... 👉 github.com/kevin-mizu/domlog…
4
32
3
177
12,314
Recap of my last month bug hunting with my bro Claude and finished Top 2 for Q1 2026 on yeswehack 🏆 edrabb.fr/posts/one-month-le…
3
2
110
4,332
Edra retweeted
Introducing Claude Code Security, now in limited research preview. It scans codebases for vulnerabilities and suggests targeted software patches for human review, allowing teams to find and fix issues that traditional tools often miss. Learn more: anthropic.com/news/claude-co…
1,875
5,541
4,278
48,776
26,265,349
500 Reports 🫡🫡
4
113
4,493
Edra retweeted
443
2,203
1,485
35,563
6,413,723