Write-upOther
Settlement amount tampering on refund API
How a critical other in Webhook delivery service was found, reported to Orbit Payments and fixed.
4 min26 days ago
pa
@parseltongue
Rank 04VerifiedAisha R. · Kenya · Joined May 2024
Cloud-focused researcher chasing SSRF, metadata exposure and misconfigured control planes.
CloudSSRFInfraAPI
Reputation
7,855
Valid findings
128
Critical
15
Acceptance
100%
Programs
19
Bounty earned
$164,300
Achievements
First Blood ×7
First valid report on a program.
Cloud & infrastructure Specialist
Verified skill badge in cloud & infrastructure.
Clean Reporter
90%+ acceptance over 100+ reports.
Severity breakdown
Critical15
High42
Medium46
Low25
Notable findings
| Severity | Finding | Program | Bounty |
|---|---|---|---|
| Critical | Settlement amount tampering on refund API | Orbit | $15,000 |
| Critical | Container escape from a streaming session | Vertex | $9,000 |
| Critical | Subscriber provisioning callable unauthenticated | Solstice | $20,000 |
Writing
Activity timeline
RecentlyResolved a critical finding on Orbit — awarded $15,000.
EarlierReached Rank 04 on the all-time leaderboard.
May 2024Joined datacoconut.