Coordinated disclosure only.
Independent web and application security research, reported only through each program's coordinated-disclosure channel and recorded here at the level of vulnerability class.
Wispr AI security team
“Researchers rarely volunteer the boundary of their own work, and it is the part of this engagement we found most creditable.”
Acknowledges four reports across four vulnerability classes, all confirmed valid, with a note on methodology and disclosure conduct.
ImpactGuru
View hall of fame (opens in a new tab)
Logos are trademarks of their respective owners; listed to indicate authorized program participation.
Platforms: HackerOne · Bugcrowd · Intigriti · YesWeHack · Self-hosted programs
Hover a class to trace it in the ledger; select it to filter.
Showing all 22 findings
| Platform | Vulnerability class | CWE | ||||
|---|---|---|---|---|---|---|
| Wispr FlowLetter of recognition | Self-hosted program | Update-channel integrity weakness enabling code execution (Windows client) | CWE-494 | High severity | Sep 2026 | Rewarded · $X,XXX |
| ImpactGuruHall of Fame | Self-hosted program | Account creation without identity verification | CWE-287 | Medium severity | Sep 2026 | Rewarded |
| Stay22 | Self-hosted program | Step-up authentication bypass | CWE-306 | Low severity | Sep 2026 | Rewarded |
| Dynatrace | HackerOne | Hard-coded credential exposure (non-production environment) | CWE-798 | Low severity | Sep 2026 | Accepted |
| Wispr FlowLetter of recognition | Self-hosted program | Improper access control in enterprise domain-join (organisation auto-join) | CWE-269 | High severity | Sep 2026 | Accepted |
| Wispr FlowLetter of recognition | Self-hosted program | Cleartext storage of sensitive data at rest (client session tokens) | CWE-312 | High severity | Sep 2026 | Accepted |
| Wispr FlowLetter of recognition | Self-hosted program | Authentication bypass in desktop protocol handler (deep-link tokens) | CWE-384 | High severity | Sep 2026 | Accepted |
| GetYourGuide | HackerOne | Server-Side Request Forgery (SSRF) | CWE-918 | Medium severity | Sep 2026 | Accepted |
| Vistaprint | Bugcrowd | OIDC redirect_uri validation weakness (open redirect class) | CWE-601 | Medium severity | Sep 2026 | Accepted |
| ImpactGuruHall of Fame | Self-hosted program | Broken Object-Level Authorization (cross-account PII) | CWE-639 | High severity | Aug 2026 | Rewarded |
| TrekMailHall of Fame | Self-hosted program | Brute-force protection bypass | CWE-307 | Medium severity | Aug 2026 | Rewarded |
| TrekMailHall of Fame | Self-hosted program | OAuth scope restriction bypass (third-party storage integration) | CWE-863 | Medium severity | Aug 2026 | Rewarded |
| Forex Factory | Self-hosted program | CSRF via HTTP method override | CWE-352 | Medium severity | Aug 2026 | Rewarded · $XXX |
| Read AI | Self-hosted program | Missing authorization on cross-tenant write | CWE-862 | High severity | Aug 2026 | Accepted |
| Read AI | Self-hosted program | Server-Side Request Forgery (SSRF) | CWE-918 | Medium severity | Aug 2026 | Accepted |
| CareEvolution$XXXX total · 3 findings | Self-hosted program | Cross-organisation file read (Broken Object-Level Authorization) | CWE-639 | High severity | Aug 2026 | Rewarded |
| CareEvolution | Self-hosted program | Patient record enumeration | CWE-204 | Medium severity | Aug 2026 | Rewarded |
| CareEvolution | Self-hosted program | Client account enumeration | CWE-204 | Medium severity | Aug 2026 | Rewarded |
| Manatal | Self-hosted program | Exposed administrative interface | CWE-284 | Medium severity | Aug 2026 | Accepted |
| Withings | YesWeHack | CORS misconfiguration with session identifier in URL | CWE-942 | Medium severity | Aug 2026 | Accepted |
| Plusgrade | Bugcrowd | Exposed third-party administrative asset | CWE-200 | Medium severity | Aug 2026 | Accepted |
| Bentley Systems | Self-hosted program | OAuth token exposure | CWE-522 | Low severity | Jul 2026 | Rewarded |
Wispr FlowLetter of recognition
High severityUpdate-channel integrity weakness enabling code execution (Windows client)
ImpactGuruHall of Fame
Medium severityAccount creation without identity verification
Stay22
Low severityStep-up authentication bypass
Dynatrace
Low severityHard-coded credential exposure (non-production environment)
Wispr FlowLetter of recognition
High severityImproper access control in enterprise domain-join (organisation auto-join)
Wispr FlowLetter of recognition
High severityCleartext storage of sensitive data at rest (client session tokens)
Wispr FlowLetter of recognition
High severityAuthentication bypass in desktop protocol handler (deep-link tokens)
GetYourGuide
Medium severityServer-Side Request Forgery (SSRF)
Vistaprint
Medium severityOIDC redirect_uri validation weakness (open redirect class)
ImpactGuruHall of Fame
High severityBroken Object-Level Authorization (cross-account PII)
TrekMailHall of Fame
Medium severityBrute-force protection bypass
TrekMailHall of Fame
Medium severityOAuth scope restriction bypass (third-party storage integration)
Forex Factory
Medium severityCSRF via HTTP method override
Read AI
High severityMissing authorization on cross-tenant write
Read AI
Medium severityServer-Side Request Forgery (SSRF)
CareEvolution$XXXX total · 3 findings
High severityCross-organisation file read (Broken Object-Level Authorization)
CareEvolution
Medium severityPatient record enumeration
CareEvolution
Medium severityClient account enumeration
Manatal
Medium severityExposed administrative interface
Withings
Medium severityCORS misconfiguration with session identifier in URL
Plusgrade
Medium severityExposed third-party administrative asset
Bentley Systems
Low severityOAuth token exposure
01
I read a program's policy before I send a single request. What is in scope, what is excluded, which test accounts I may use and what rate limits apply decide where I look, and anything outside those lines stays untouched, however interesting it seems.
02
I report what I can show matters: another user's data, an action taken on someone else's behalf, a control that fails on the thing it is meant to protect. Each report carries clear reproduction steps and an honest severity, and theoretical best-practice gaps stay out of the queue.
03
Every finding goes to the program through its own channel and stays private until it is resolved. This page lists vulnerability classes only, never endpoints, payloads or anything that would help someone repeat the issue.
04
I use my own accounts wherever possible and touch the minimum needed to prove a point. When a finding exposes someone else's information, I stop at confirmation, never pull more records than the proof needs, and keep nothing beyond what the report itself requires.
I also taught this material through GDG SecLabs, the security masterclass series I founded at GDG On Campus KIIT and ran from Aug 2024 to Nov 2025. See the CV →