https://xitter.cf/t.co/WdqwxN6DEV is more than just the best AI auditing service, we are now a community of 100+ and growing SR's working together. DM for private Audits
Joined August 2025
- Tweets672
- Following291
- Followers177
- Likes560
Pinned Tweet
Those that have been asking to join our community and group discord to work in teams, I will be spending the next 8-10 hours accepting and verifying members, please when you apply put your X handle in the application answers, as well as your github and bug bounty profiles, try to make sure you have cross links so I can verify the profiles do in fact belong to you so we can quickly get you situated into a team role!
I am so excited and looking forward to getting to know more people, and working all together to make web3 more secure than it's ever been!
discord.gg/rwEEsJ7RX
Happy 2nd birthday to my little Archie dude <3 So impressed and blessed by this boy, grateful I get to be Dad to such amazing kids, even if he earns his nickname if Archole sometimes lmfao.
"The mechanic you've shown is real, however at the present is not a problem and only affects one path"
Worst excuse for an invalid I've ever heard, sure present moment doesn't cause a risk, doesn't mean that the risk isn't there.
Set backs happen, but when you know who God made you to be, you know that it's not the end, it's just the beginning. Thats what I learned reading first and second Samuel. Was nice timing as well
Nothing like finding a solid High then doing a final check through PR's/Issues to see that between the start of your search and the present the team shipped a patch lmfao.
Still some good subs going in today but that one was a bit disappointing
Tucker - AuditAid.io retweeted
daily challenge 🔥 day 19 of 100
independent Solana audit. real team. real codebase. 🌊🤝
shoutout @CrucibleCrypto for making this happen 🙏
leads found on day 1 🚨👀
and reading Solana programs with ease now? 🤯
that is 19 days of reps paying off right there 💪🔥
After 5 years in Germany I used to say you couldn't pay me to move back, but now I think you could probably pay me to move to Florida. Pretty dope place now.
Really excited to grind out a Solana audit with @0xenzo_eth and some others from the Audit Aid community.
A couple promising bounty submissions to drop on immunefi on Monday.
Lots of work to catch up on this week, excited to learn and to grind
a lost passport, bad customer service and a missed flight, a lost but returned wedding dress, honeymoon house breaking, and 3 kids sick.
None of it could cause strife between us, a beautiful wedding it was despite all the stress and things that could go wrong...going wrong.
The difference between blockchains and life is - things never end well when something goes wrong, in life, everything can go wrong, but patience, grace, and a whole lot of love can make even the worst moments seem small in the face of God's big love
Reposting this for future reference
free alpha for Solana auditors 🧵
if account constraints in Anchor ever make your head spin
this is your reference sheet 🔐
anchor-lang.com/docs/referen…
all the constraints. all in 4K. no excuses 🤯🔥
Officially married:
Been a nice break so far - couple days of honeymoon now and I will be back on the grind!
Tucker - AuditAid.io retweeted
Post @code4rena shutdown y’all thought no more competitions. C4 continues on @immunefi 🫡
Day 50 was a good day with a slice of humble pie.
Advancing with new teams, scheduling, balancing other's expectations, moving towards goals.
Had an amazing hang out with a new, but good friend. We talked about God and Church and discipleship. I had the realization most churches wouldn't want me preaching because I'd rather wait for the spirit to lead me in what needs to be said than try to write a sermon that aligns with their doctrine, the sad reality is many churches reflect the Pharisees in the time of Christ than they do Christ himself, but that's not to say there's no value in the structure or communities. Just people desperate from a drink from the well with "leaders" trying be the pipes through which it flows instead of leading people to the source.
One week and two days until I marry the most amazing woman in the world, her heart for God is changing the world around us, has changed the world around me, and she has helped me step into the role God laid out for me.
A must read for those in my group
💰🚨 $1.4M from Web3 bug bounties in 2026!
Meet @0xvivekd and learn about his journey, mindset, AI workflow, and the lessons he's learned along the way.
Part 1: The Journey
- Vivek didn't come from a software engineering background.
- He was a Chartered Accountant (licensed financial and tax professional) running his own firm.
- In 2021, a friend who traded crypto came to him for help filing taxes. That's how he got introduced to crypto and started investing, mainly participating in IDOs (Initial DEX Offerings).
- When the bear market arrived, he didn't leave the industry. He pivoted into data analysis.
- Then in 2023, as the market became active again, he started airdrop farming.
- In June 2024, he entered Web3 security through public audit contests.
- The next 15 months were difficult.
- He kept participating in contests but struggled to achieve consistent results.
- Around August/September 2025, he made a decision that completely changed his career.
- He switched from public audit contests to bug bounties.
Today, he has earned over $1.3M in bug bounties in 2026 alone, including another $250,000 critical bounty announced yesterday.
Part 2: The Mindset
- "Bug bounties are not difficult in the technical sense. They are difficult from a psychological point of view."
- He explained what led him to leave audit contests:
- During a White Hat Mastermind, everyone was asked what they were working on.
- Around half of the researchers were working on the contest with the smallest scope and the lowest payout.
- Vivek realized he was always choosing the easiest targets because they offered the fastest and most predictable payouts.
- Bug bounties were different. There was no guarantee of finding anything. No guaranteed payout. Sometimes weeks of work could lead to nothing.
- That was exactly why he switched.
- As he put it:
"Bug bounty hunters are paid handsomely for dealing with uncertainty."
Part 3: AI
- AI has completely changed Vivek's workflow.
- Today, he gives AI a target while he spends that same time building a high-level understanding of the protocol.
- Once AI surfaces potential issues, he validates them, removes false positives, and determines whether they're actually valid vulnerabilities.
- His estimate surprised me.
Today, around 70-80% of the issues are initially surfaced by AI.
- But he doesn't believe AI will replace security researchers. His reasoning is simple.
- AI is excellent at spotting unusual behavior. It still struggles to understand intended behavior. That's why human validation remains essential.
- He also believes the learning process has changed.
- Reading audit reports and recent hacks is still fundamental, but today researchers should also follow AI developments and continuously experiment with AI tools.
Part 4: Advice
- According to Vivek, DISCIPLINE is what separates the best researchers from everyone else.
- His advice was straightforward:
Don't expect meaningful results during your first 12 months. Focus on the inputs, not the outputs. Don't compare yourself to researchers who have been building their skills for years. Stay disciplined. Don't chase shiny objects. Keep adapting as the industry evolves.
- One detail I really liked was how he dealt with difficult periods.
- Whenever he went through a dry spell, he listened to podcasts from other top white hats.
- Not because they never struggled. But because they did.
- It reminded him that even the best researchers experience periods without finding bugs.
Congratulations on the incredible journey! @0xvivekd. 👏
Bro needs a new therapist, he/she just doesn't understand
Bug bounty hunting isn't easier or harder than it used to be
Getting rewarded, however, is harder, mostly because of duplication (happened again 12 hours ago 😮💨)
The (harder-to-find-than-before) low-hanging fruits have already been picked up
Everyone finds the same bugs because everyone uses the same tools
The rules haven't changed... if you do what everyone does, you'll get the same result as everyone
During the manual-audit era, everyone was focusing on the "easy" parts of the code, the ones that didn't require friction
The results were average: you'd end up in the pack of the leaderboard, with average payout
History is repeating and we can learn from it!
The tools researchers and teams make available to the public (god bless them) are helpful, yes
BUT using them is the "easy" part of the job
What's gonna make you stand out is to use them differently, build on top of them, improve them, create your own
I'm personally experimenting an approach people don't talk about (yet?) and I'm confident it will pay off very soon
Day 49 of Audit Aid community leadership:
The community has grown to 80 people now - 5 working teams. Today we are starting another competition while teams are setting themselves goals like $100k in bounties over the next month.
I've been playing with Open-Kritt, learning it's system, it's strengths and weaknesses. Made some changes first to make it work with Cursor, and with Kimi, it's a solid system, very worthwhile. Looking at how I can create a better mixture between it and Audit Aid's system.
One thing I love about Audit Aid is it's flexibility, being built to run even on serverless hosting, but that also comes with it's own sets of weaknesses. Currently I've run the two systems a few engagements in parallel. Looking to fully integrate the two though, as well as bringing in the Pashov Skills of what's not already covered in the system.
I leave in 3 days for a trip back to the US, 3 weeks - 2 with the whole family, and finally having a wedding ceramony with the love of my life. Then she comes home a few days early, I stay with my boys an extra week to visit my family and have some special time with just us boys.
It's gonna be tough that I will need to spend a few of those days working the first week and a half I am there, but big things are coming from me personally, and even bigger things from the teams, Im so stoked and excited.
Day 46 and 47
So far my Immunefi Journey:
1 medium dupe - invalidated
1 high(borderline crit but low funds at risk presently so I marked high) - 28 days over SLA
1 web/app crit almost 2 weeks over SLA
Just now -
1 Crit submitted - decent amount of funds at risk but nothing that compares to most of this year's insane Drains.
Probably my strongest submission yet, hoping it's not a dupe.
Honestly, it's just fire, forget, continue the hunt - I still have about 11 leads to go through on the protocol I just submitted to - most on the surface are just defense in depth, the question is if there is exploitability from composition or a route I haven't looked at yet - a couple are low/medium impact OOS on immunefi - will verify and open a security alert or github issue for the team in good faith once I've had a chance to validate.
Today is solo work - it's nice - yesterday I got the 2 new audit aid Discord teams laid out in the spreadsheets (I fucking hate excel ngl) this type of work is my weakness, but for my community I do it because of how much these people remind me that what I've done to build this has been so great for them.
The teams are gearing up for bug bounties and for the Anza comp coming up tomorrow.
I've been eating my ego about auditaid.io and learning to adapt and integrate outside systems that are coming out and allow it via open source licensing.
Looking forward to open sourcing the changes I've made to open kritt to allow it to run with cursor as well as with models like Kimi k3. Combined with AuditAid, pashov skills, manually directed ai workflows and manual review + reattacking it helped me surface the crit I just submitted.
The amount of dopamine that I receive from smashing flys with a fly swatter - I could do this for a living - if you're located in the münsingen, Deutschland area feel free to hire me, I will work for a cup of coffee or a cold bier depending on time of day, a cash tip is welcome
Kinda gives me the ICK that people charge for teaching Web3 security ngl.
In our discord we work together and learn together, our team leads are all advanced hackers with a long history on multiple platforms. They work with 1 mid level and 3 new/junior guys. Teach, share resources, split bounties. Audit Aid takes 5% from each team's finds to help not only pay the submission fee for paid bounties, but also 20% of that is set aside to get access to paid online classes for brand new web3 auditors who are hungry and showing their willingness to learn and work hard.
The value of a business isn't how much it can get out of people, it's how much value it provides people. That's my goal, provide value, raise people up, make the world a better place.
Without the amazing people in the Audit Aid community I couldn't do what I do, the community is them, not me.