Disclosure & practice · Patrik Grobshäuser https://patrik.re/topics/disclosure/ Reporting bugs, working with vendors, and life inside bug bounty programmes. en-GB Wed, 20 May 2026 00:00:00 +0000 To Kara, Alex, and Michiel — Your Researchers Are Leaving https://patrik.re/to-kara-alex-and-michiel-your-researchers-are-leaving/ https://patrik.re/to-kara-alex-and-michiel-your-researchers-are-leaving/ Wed, 20 May 2026 00:00:00 +0000 Bug bounty platforms never humanized researchers or triage. Now they're drowning in AI slop and wondering why their best people are leaving. patrik.redisclosureai-security BillMeLater: XSS Through a Style Attribute https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ https://patrik.re/bugbounty-reflected-cross-site-scripting-billmelater/ Mon, 17 Nov 2014 00:00:00 +0000 A Firefox-only reflected XSS on wwwb.search.billmelater.com, achieved by closing out of a style attribute and injecting a fresh script element, which the vendor classified as out of scope. patrik.reweb-exploitationdisclosure Stored XSS in Three WordPress Chat Plugins https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ https://patrik.re/wordpress-3x-vulnerable-chat-plugins-3/ Thu, 02 Oct 2014 00:00:00 +0000 WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install. patrik.reweb-exploitationdisclosure Chrome backslash URLs and XSS filter bypass https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ https://patrik.re/google-chrome-security-multiple-leading-slashes-in-urls-may-confuse-some-server-side-xss-filters/ Tue, 17 Jun 2014 00:00:00 +0000 Chrome resolves and executes a script URL written as http: followed by any number of backslashes. Firefox does not, and that difference can slip past pattern-matching XSS filters, closed by Chromium as wontfix. patrik.reweb-exploitationdisclosure Path Traversal on map.prezi.com ($1,000) https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ https://patrik.re/bug-bounty-prezi-map-prezi-com-path-traversal/ Wed, 21 May 2014 00:00:00 +0000 A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty. patrik.reweb-exploitationdisclosure 160 German tax office sites vulnerable to XSS https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ https://patrik.re/were-on-heise-german-found-160-sites-vulnerable-to-xss/ Mon, 11 Nov 2013 00:00:00 +0000 Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation. patrik.reweb-exploitationdisclosure