XSS in Google Tag Manager via JSON Import
Google Tag Manager validated macro names in the web UI but not in the JSON container import path, so a payload smuggled through a file upload executed and earned a $5,000 bounty.
Filter bypass
Validation on one path and nothing at all on the other. That gap is where the payload goes.
2014
Chrome backslash URLs and XSS filter bypass
Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix.
Seven PayPal Bugs, Zero Bounties
A 2014 run through PayPal's bug bounty scope: seven confirmed issues across paypal.com, financing.paypal.com, apps.paypal.com and the paypal-*.com family, all closed as duplicate or invalid.