Totobarjo (@Totobarjo2) header
Totobarjo (@Totobarjo2) profile picture
Joined March 2021
Photo by Totobarjo (@Totobarjo2)Photo by Totobarjo (@Totobarjo2)
❗️ HackerOne's AI bot blocked bug hunter Will Dormann's report because its CVE was "from the future." The bot thought it was 2024. He got past it by rewriting CVE-2026-114820 as CVE-[redacted]-114820. HackerOne is solving AI slop "by introducing a layer of AI slop," he says.
34
47
20
635
61,740
Nouvelle idée pour les crédits @yeswehack : Quand un hunter atteint un gros score, il débloque le droit de noter les programmes. +4 pts pour un triage propre -4 pts pour “N/A” ou "NMI" après 3 mois -10 pts pour “working as intended” quand tu get full PII
6
3
23
1,144
Totobarjo retweeted
Let’s be clear: @Hacker0x01 is using researchers’ work to train their AI and profit from it without consent. That’s not “innovation” — that’s exploitation. Our reports, our research, our time — turned into their product, while we get nothing. This violates client agreements. Vulnerabilities belong to the companies and the researchers — not HackerOne. Yet they’re monetizing it anyway. Layoffs, shrinking bounties, and now this? The platform is collapsing, and instead of fixing it, they’re squeezing the community that built it. Researchers made HackerOne. Programs trusted HackerOne. And now both are being treated like disposable data sources. If you’re a company, review your contracts immediately. If you’re a researcher, stop feeding them your work. HackerOne isn’t supporting the community anymore it’s exploiting it. And people are finally waking up. Many programs have already shifted to self-hosted , such as Salesforce. #BugBounty
Thread - My own opinion & this is to the Bug Hunters, What @Hacker0x01 is doing re AI, is essentially stealing “our work” “our research” for their own profitability. They are for sure breaking client agreements, wherein a clients data / vulns belong to the client. Not H1!!
12
30
2
223
15,450
Totobarjo retweeted
Thread - My own opinion & this is to the Bug Hunters, What @Hacker0x01 is doing re AI, is essentially stealing “our work” “our research” for their own profitability. They are for sure breaking client agreements, wherein a clients data / vulns belong to the client. Not H1!!
14
29
5
228
58,708
🚨 Doing a giveaway for my Blind XSS Masterclass Most people think they know XSS, until they meet blind XSS, the kind that fires where you’ll never see it. Same methods that helped me earn $250K+ from real reports. hhub.io/nahamsecbxss 🎁 Retweet and reply to enter.
382
370
10
712
78,037
🚨𝗧𝗛𝗘 𝗨𝗟𝗧𝗜𝗠𝗔𝗧𝗘 𝗚𝗜𝗧𝗛𝗨𝗕 𝗗𝗢𝗥𝗞𝗦 𝗟𝗜𝗦𝗧 𝗩𝟯 🚨 A total of now 𝟱𝟬𝟬+ dorks for sensitive information exposure to find easy wins. Text file and my tool to automate these dorks tinyurl.com/gitdorks #BugBounty #bugbountytip #bugbountytips #github #infosec
13
443
16
1,259
📢 THE TIME HAS COME📢 Today I make public ALL *recordings* and updated slides (+ FAQ) for my mobile security class, MOBISEC 2020! Everything is available, for free, at: mobisec.reyammer.io/slides! Few words about this release in a short thread 👇
23
400
25
1,012
Due to your request I just posted it on my GitHub! :) github.com/dirsoooo/dotfiles
2
7
12