iiinova — where your digital self keeps evolving

Alex Chapman @ajxchapman.bsky.social · 13/10/2026

It's the worst outcome for everybody. Programs are flooded with low quality & low impact reports that burn time and budget for little to no real security gain, and experienced bug hunters end up waiting months to _maybe_ get their High and Critical impact reports looked at and paid out

100

Alex Chapman @ajxchapman.bsky.social · 13/10/2026

Agreed, the marketing was _always_ quantity over quality focused. It was a foot-gun waiting to go off from the start

010

Alex Chapman @ajxchapman.bsky.social · 13/10/2026

Hot take, Bug Bounty is not a field for beginners, and should never have been promoted that way. The root cause of 90% of the problems programs face can be attributed to this. It's time we ditch this old framing, and instead promote Bug Bounty as a field for professionals.

120

Alex Chapman @ajxchapman.bsky.social · 09/10/2026

If I were a Bug Bounty platform in 2026, I'd implement two policies _right now_: 1. Require KYC for accounts before allowing bounty submissions 2. Take care of hunters who are consistently reporting Critical impact issues And one more for free, stop promoting BB as a beginner friendly discipline

031

Alex Chapman @ajxchapman.bsky.social · 08/10/2026

If I were a Bug hunter in 2026 (oh wait I am!), I'd implement two policies _right now_: 1. Stop reporting Low, Medium and speculative bugs 2. Spread your efforts across a large number of programs / platforms And one more for free, bank as much as you can now, the future of BB is going to be wild!

020

Alex Chapman @ajxchapman.bsky.social · 07/10/2026

If I were running a Bug Bounty program in 2026 I'd implement two policies _right now_: 1. Stop paying for Low and Medium impact bugs 2. Prioritise triage for known good bug hunters to your program (rep, impact, bounty sum etc.) And one more for free, use the ban hammer liberally and often.

041

Reposted by Alex Chapman

cje @cje.io · 01/09/2026

"What is a bug worth" has always been *the* question: The Vulnpocalypse Is Repricing the Bug Bounty Economy www.darkreading.com/vulnerabilit...

darkreading.com

The Vulnpocalypse Is Repricing the Bug Bounty Economy

The surge in AI-powered vulnerability reports is driving down bug bounty prices, and that could spell trouble for independent researchers.

0105

Alex Chapman @ajxchapman.bsky.social · 24/08/2026

My first daughter would have been 8 today. Instead of joy and happiness on her birthday, my family live with a deep sadness on this day. Chloë was stillborn as a result of Edwards Syndrome. I miss her so much, a beautiful life that could have been but was never given the chance. I love you baby, Dad

010

Alex Chapman @ajxchapman.bsky.social · 12/08/2026

Anyone know how to find the focal point of a colander ☀️🌙🌕

010

Alex Chapman @ajxchapman.bsky.social · 24/07/2026

That's awful, I'm so sorry Ian!

000

Alex Chapman @ajxchapman.bsky.social · 15/05/2026

Honestly if programs/platforms were transparent about current traige times it would help a lot!

000

Alex Chapman @ajxchapman.bsky.social · 15/05/2026

If you run a Bug Bounty program (or platform) now might be a good time for you to publish the average time to triage for various issue severities. There are a _lot_ of disgruntled hackers out there at the moment who are waiting weeks / months for a program to even perform a first look at a report!

3111

Alex Chapman @ajxchapman.bsky.social · 11/05/2026

Bug Bounty is remotely debugging last year's unreliable n-day using last week's reliable n-day... which I can't report because the vendor needs "time to patch." 🤦

040

Reposted by Alex Chapman

Ollie Whitehouse @ollieatnowhere.bsky.social · 10/05/2026

Heading to OffensiveCON this week? Thank you for coming to my talk... claude.ai/share/227b48...

0111

Reposted by Alex Chapman

Patrick Gray @patrick.risky.biz · 04/05/2026

If you would like to see a preview of @jameskettle.com's Blackhat talk "the HTTP terminator" then check out this interview my colleague @jameswilson.io recorded with him. Some pretty freaky stuff! VIDEO: www.youtube.com/watch?v=GdFG... AUDIO: risky.biz/RBNEWSSI126/

youtube.com

Sponsored: James Kettle built an AI hacker

YouTube video by Risky Business Media

2147

Alex Chapman @ajxchapman.bsky.social · 14/04/2026

There needs to be consequence for those hackers that waste triage resource and benefit for those who provide clear, easy and possibly automatable reproduction steps. The first platform that offers me as a proven, experienced and reliable bug hunter preferential triage wins my loyalty in 2026.

010

Alex Chapman @ajxchapman.bsky.social · 14/04/2026

100%, this is not a triager problem. To triage efficiently for an ever increasing number of (both human and automated) hackers would require a continued _huge_ investment in triage workforce, and even then would be unsustainable. If anything, it's a hacker problem.

100

Alex Chapman @ajxchapman.bsky.social · 14/04/2026

2026 and Bug Bounty triage is broken. This has on the horizon for years, even without LLM pressure, but it still seems to have caught _every_ major platform and large private program by surprise.

0121

Reposted by Alex Chapman

James Kettle @jameskettle.com · 14/04/2026

I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at Black Hat USA! Check out the abstract: blackhat.com/us-26/briefi...

0135

Alex Chapman @ajxchapman.bsky.social · 11/04/2026

☝️ Triage times across all platforms have sky rocketed. In the before times triage of 2+ days for higher impact bugs was unusual, now we are often into weeks. I really like @intigriti.com's approach, if you are reporting valid bugs you see no difference, if you are reporting crap you get penalised.

030

Alex Chapman @ajxchapman.bsky.social · 25/03/2026

The VSCode remote editor function has really gone to crap recently. Any form of linting is just spinning server CPU at 100% and OOM killing random processes. Going to have to go back to filesystem monitoring and rsync at this rate.

040

Alex Chapman @ajxchapman.bsky.social · 24/03/2026

Seems like a pretty good job for an LLM. Just started with name extraction

Here are the dedications extracted from the JSON provided, along with the names of the people they are dedicated to:
"The Oxford Kid"
Dedication: "Donated by the Godfrey Family in memory of 'THE OXFORD KID'"
John Fairbairn Warin
Dedication: "John Fairbairn Warin Medical Officer of Health Oxford 1948 - 74 From the people of Iffley"
Kaushik (Kris) Shah
Dedication: "Dedicated to Kaushik (Kris) Shah who loved these gardens and shared them with his family"
Harold Swindells
Dedication: "Harold Swindells Co-founder of Bath Postal Museum He enjoyed walking in this park and liked to stop and look at every tree. This Always made him smile because he loved trees"
Sophie Hyan
Dedication: "For Sophie Hyan 1908-2004 who spent so many happy hours in this park from her Loving family"
Dennis Leach
Dedication: "Dennis Leach Renowned Bath Artist Forever in our hearts"
Hugo John Wolfe
Dedication: "Donated by the family of Hugo John Wolfe Always Loved"
Frederick and Phyllis Hardick
Dedication: "Frederick and Phyllis hardick"
Madge Alithea Gould
Dedication: "In loving memory of Madge Alithea Gould 1901-1991 who loved this garden"
Doris Edna Astbury
Dedication: "Donated on behalf of Doris Edna Astbury 24/12/96"
Ben
Dedication: "This park meant so much to Ben our friend 1979-1989"
Kitty Potin and her brother Edgar
Dedication: "This seat has been donated for Kitty Potin and her brother Edgar"
Ruth Margaret Lawler
Dedication: "Donated for Ruth Margaret Lawler"
Jean Kathleen Moore
Dedication: "Jean Kathleen Moore 1916-1999 she loved this park"
James & Phyllis Balneave
Dedication: "JAMES & PHYLLIS BALNEAVE A DEVOTED COUPLE LOVINGLY REMEMBERED"

101

Reposted by Alex Chapman

renniepak @renniepak.nl · 19/03/2026

When reviewing pull requests with new additions for CSPBypass.com, I often find myself questioning how useful a given entry actually is. If no websites whitelist a specific host, there is little point in adding it.

155

Alex Chapman @ajxchapman.bsky.social · 10/03/2026

Every bug hunter / vulnerability researcher / pentester should have to write their own blind or timing based SQL injection tool. It's like a rite of passage, if you've taken the time to understand and produce your own you'll probably make it in this world, if not 😬 x.com/slonser_/sta...

152

Reposted by Alex Chapman

mkultra tournament edition @amenbreakpoint.com · 10/03/2026

Last BSidesNYC I sat behind a guy doing the CTF with ChatGPT. Ctrl-a paste page source and a screenshot, hit enter, repeat. User totally not reading the output. LLM got the flag (flappybird-style JS challenge) after maybe ten rounds of this. Last message dude sent in the session was "We did it!".

141

Alex Chapman @ajxchapman.bsky.social · 10/03/2026

Yeah this is 100% what I'm talking about, it _is_ happening, and a whole lot of people are going to be voluntarily less knowledgeable because of it. LLMs are a tool of the future, but we don't need to stop learning because of it.

030

Alex Chapman @ajxchapman.bsky.social · 10/03/2026

I think it's highly likely we'll end up in a split tier future of those that use LLMs without learning, and those that seek to understand what the LLM is doing and learn from it. I believe the latter is the much more desirable camp to be in.

010

Alex Chapman @ajxchapman.bsky.social · 10/03/2026

This post on LLM use in CTFs sums up my feelings on the subject nicely. vt.social/@lina/116198... When simply directing LLMs for development / security research / CTFs it's quick, often accurate, often useful, but I don't inherently learn anything other than how to direct the LLM.

vt.social

Hoshino Lina (星乃リナ) 🩵 3D Yuri Wedding 2026!!! (@lina@vt.social)

There's a lot of discourse on Twitter about people using LLMs to solve CTF challenges. I used to write CTF challenges in a past life, so I threw a couple of my hardest ones at it. We're screwed. At ...

341

Alex Chapman @ajxchapman.bsky.social · 04/03/2026

What I'm waiting for: Email updates to 5 separate Bug Bounty reports What I get: Email notifications of 3 year old reports being closed 😭

230

Alex Chapman @ajxchapman.bsky.social · 26/02/2026

I wouldn't even attempt to report a bug to a company without at least a VDP / security.txt / security@ these days. The amount of effort for sometimes less than 0 appreciation is just not worth it.

020

Alex Chapman @ajxchapman.bsky.social · 29/11/2025

If you are selling a mirror and your ad creative includes images of the product with impossible reflections, I'm going to have to go ahead and assume your product doesn't work very well!

110

Alex Chapman @ajxchapman.bsky.social · 05/11/2025

I'm sympathetic to corporate policy "patch gaps", but when it's framed as "acceptable exploitation window" it hits on a different level 🤔

280

Reposted by Alex Chapman

Rhianna Pratchett @rhi.bsky.social · 07/10/2025

Dad’s books are full of empathy, common sense, and a healthy suspicion of the powerful. But at its heart his work is also about how systems keep people poor while pretending it’s their own fault. So I hope Kemi’s taking notes as well as reading the jokes.

13877601966

Alex Chapman @ajxchapman.bsky.social · 29/09/2025

"Despite repeated warnings over X's evolution into what some might describe as a wretched hive of scum and villainy, governments and organizations are still reluctant to leave the social media platform" 🔥

101

Reposted by Alex Chapman

Alex Chapman @ajxchapman.bsky.social · 28/09/2025

An in depth summary of the consequence of Google VRP increasing bounties in 2024. "We observe statistically significant increases in the reporting of high-value bugs, especially in the highest impact tiers and high merit submissions." 🔥 arxiv.org/abs/2509.16655

arxiv.org

Incentives and Outcomes in Bug Bounties

Bug bounty programs have contributed significantly to security in technology firms in the last decade, but little is known about the role of reward incentives in producing useful outcomes. We analyze ...

083

Alex Chapman @ajxchapman.bsky.social · 28/09/2025

arxiv.org

Incentives and Outcomes in Bug Bounties

083

Alex Chapman @ajxchapman.bsky.social · 18/09/2025

The new favourite fidget toy on my desk is the Zippo lighter I've had since I was a teenager. There is something about the noise of the cap flipping open and flint sparking. This has replaced the ever popular poker chips. Needless to say, I am not a great example for my kids 😬

220

Alex Chapman @ajxchapman.bsky.social · 16/09/2025

Hackers tops the list of films that have influenced my life. Without seeing this film as a young teen I may not have misspent my youth in front of a computer trying to understand how it all worked. Which, despite what my parents suggested at the time, seems to have worked out well for me 😆

090

Alex Chapman @ajxchapman.bsky.social · 15/09/2025

Back in the day when I was hopping around flats in London I got all of them though scraping rental and roomshare adverts (mostly Gumtree at the time) so I could be the first person to respond and see a place. It's definitely an underrated technique!

110

Alex Chapman @ajxchapman.bsky.social · 12/09/2025

That feeling when you finally read that blog post you've had open in a browser tab for 3 months, and it's complete garbage 😑

0312