Viewing profile — franjkovic

Every Twitter's bounty amount is divisible by 140.

I wanted to move from Blogspot to a personal domain, but kept delaying it for a long time.

>how many hours did you spend researching this? Two to three hours discovering and writing the initial report, couple more hours (unsuccessfully) trying to escalate it using pre-ap…

The bug was reported on December 8th, 2015 and fixed on February 18th, 2016 which is an unusually long time for Facebook. The bounty reached my account during the middle of March, …

The post is interesting, but I do not know why people assume they would get a bounty for a security report if the company does not have responsible disclosure / bounty program.

I'd say it does. Not interact with other accounts without the consent of their owners. Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypa…

I think they did not reward me because you cannot really hurt anyone by having multiple usernames.

Thanks! I reported the bug to security@ email, and one of your team's members replied on the same day (January 6th). Either way, good job on fixing this really fast. I wish more te…

Facebook puts out stats from their bug bounty program once a year. Most of bugs are invalid reports - in 2013 they had 14,763 reports, with 687 being valid. ( https://www.fb.com/81…

The bounty actually surprised me, too. I expected between $1000-$2000. That is one of reasons I like reporting bugs to Facebook - they pay really good, critical bugs are fixed real…