Reading up on HackerOne
4 deep · digging since jan 08
- Closure | Playing whack-a-mole is losing
Security must shift from reactive bug‑fixing to encoding systemic invariants, because whack‑a‑mole—even accelerated by AI—fails to achieve lasting protection overall.
- $1 million hacker challenge for Vercel Sandbox - Vercel
Vercel launches a two‑week public HackerOne bounty offering up to $1 million for researchers who can escape its Sandbox microVM isolation.
- What the bliss taught us
curl maintainers took July off from vulnerability reporting, finding relief, improved productivity, and no negative impact, deeming the experiment successful.
- Notion AI: Unpatched data exfiltration
Notion AI allowed data exfiltration via indirect prompt injection in March 2025, where edits were saved before user approval, enabling attackers to steal sensitive document contents.