Security research, organised for bug hunters
67 disclosed cases with root cause and award, technique briefs for every major bug class, and scope records for 1,164 public programs. Free, cited, and available to your agent over MCP.
New to bug bounty? Start here. Want to know how this is made? About vulns.co.
Recent cases
All 67 cases- Meta Conversions API Gateway trusted message origins as script authority
Meta · Browser security · USD 62,500 · Oct 3, 2026
- Meta Accounts Center linking lost credential and identity confinement
Meta · Identity and auth · USD 30,000 · Oct 3, 2026
- Meta Conversions API Gateway mixed configuration data with executable output
Meta · Injection · USD 250,000 · Oct 3, 2026
- Meta AI media access lacked object-ownership authorization
Meta · Authorization · USD 10,000 · Oct 3, 2026
- macOS SMBFS error handling left inconsistent kernel parser state
Apple · Memory safety · USD 20,000 · Oct 2, 2026
- Meta Pixel cross-window handling lost message and token authority
Meta · Authorization · USD 32,500 · Oct 2, 2026
- Facebook SDK message authentication relied on insecure randomness
Meta · Identity and auth · USD 66,000 · Oct 2, 2026
- Safari origin confusion undermined stored media permissions
Apple · Browser security · USD 75,000 · Oct 2, 2026
Cases by topic
All topicsTechniques by bug class
All 43 briefs- SSRF
- XSS
- IDOR and broken authorization
- JWT attacks
- OAuth and OIDC
- GraphQL
- Web cache poisoning
- CSRF
- SQL injection
- XXE
- SSTI
- LFI to impact
- CORS exploitation
- WebSocket
- Race conditions
- HTTP request smuggling
- SAML attacks
- MFA / 2FA bypass
- File upload
- Agents, tools, and retrieval
- Open redirect chains
- postMessage gadgets
- Passkey and WebAuthn
- Tenant boundaries
- Web cache deception
- Session and cookie scope
- Supply chain and CI
- MCP and tool trust
- RAG retrieval boundaries
- Mobile app links
- Parsers and archives
- Security misconfiguration
- Webhook authenticity
- Email identity
- Business logic
- Subdomain takeover
- Prototype pollution
- Mass assignment
- Reset and magic links
- Clickjacking
- Cloud object storage
- Provisioning and invites
- Billing and credits
Techniques
- Briefs by bug class
43 classes, each with its playbooks, payloads and checklists
- Playbooks
70 step-by-step methods
- Skills
Review guides you can keep as Markdown
- References
155 primary sources
Programs
- Program atlas
1,164 public listings
- Reviewed policies
40 policies read in full
- Scope changes
Assets added and removed between snapshots
- Scope coverage
808 captured scope tables
Tools
- Tool directory
108 tools with install and usage
- Command generator
Build a command or a pipeline
- Browser utilities
Encode, decode and inspect locally
- CVE intelligence
KEV and EPSS signals
Built from public sources. Every record links to its origin. JSON exports and schemas · MCP and API