Write-upAuthentication bypass
Auth bypass on API token refresh
How a critical authentication bypass in *.northwind.com was found, reported to Northwind Cloud and fixed.
4 min22 days ago
r0
@r00tcause
Rank 01VerifiedPriya N. · India · Joined Mar 2024
Application security researcher focused on authentication, access control and API logic flaws. Full-time bug hunter; occasional CTF author.
WebAPIAuthenticationAccess controlBusiness logic
Reputation
9,801
Valid findings
183
Critical
27
Acceptance
100%
Programs
31
Bounty earned
$248,900
Achievements
First Blood ×12
First valid report on a program.
Critical Hunter
25+ critical severity findings.
API & GraphQL Specialist
Verified skill badge in api & graphql.
Top 1%
All-time platform reputation.
Publishes their work
3 write-ups and guides on the Learn hub.
Clean Reporter
90%+ acceptance over 100+ reports.
Severity breakdown
Critical27
High58
Medium64
Low34
Notable findings
| Severity | Finding | Program | Bounty |
|---|---|---|---|
| Critical | Auth bypass on API token refresh | Northwind | $8,000 |
| Critical | RCE in image-processing worker | Meridian | $12,000 |
| Critical | JWT signature not verified | Solstice | $9,000 |
| High | SSRF via webhook URL validator | Orbit | $3,000 |
| Low | Reflected XSS on ?q= search param | Auriga | $150 |
Writing
Reading a scope like an attacker
Most researchers skim the scope and start testing. The half hour you spend reading it properly is the highest-value half hour of the engagement.
3 min25 days ago
Write-upSQL / command injection
RCE in image-processing worker
How a critical sql / command injection in secure.meridianbank.com was found, reported to Meridian Bank and fixed.
4 min1 month ago
Activity timeline
RecentlyResolved a critical finding on Northwind — awarded $8,000.
EarlierEarned the Critical Hunter badge (25+ criticals).
EarlierReached Rank 01 on the all-time leaderboard.
Mar 2024Joined datacoconut.