12 Years of Bug Bounty Reports Show Why Filtering and Campaigns Matter

Summary

A bug bounty hunter used AI to analyze 1,500 HackerOne reports from 2014–2025, concluding that filtering and repeatable campaigns mattered more than chasing harder bugs. The review also tracks shifting bug classes and uneven report outcomes.

Key points

The analysis covered 1,500 reports across 228 programs from February 2014 to November 2025. Its classifier used report text rather than HackerOne weakness tags, but could not classify just under 20% of reports; those were excluded from percentages.
The presenter’s paid-report rate rose from 16% in 2014 to 75% in 2019. He credits filtering submissions, choosing bug classes, and running campaigns rather than simply submitting more reports.
In his dataset, CSRF, SQL injection, and standalone information disclosure reports fell to zero in his last three years. He attributes the decline to frameworks adding protections such as CSRF tokens, parameterized queries, and output encoding.
Stored XSS made up about 40% of his submissions, while its delivery shifted toward internal tools. Blind XSS rose from one report in his first three years to 45 in a single year.
His reported signal rate was 90% for subdomain takeover and 62% for remote code execution. He says RCE reports often failed over disputed impact, rather than duplicates.
A name-field injection pattern produced 107 reports across 33 programs, including a 2025 prompt-injection finding in an AI shopping assistant.
A July–November 2024 campaign used user-controlled URL fetches to identify outdated browser engines. It generated 11 reports across 10 programs, with six resolved; the presenter cautions that campaign results vary by program.

Article Details

Topics: [00:12] Report dataset and AI classification method
[03:24] Filtering submissions and running bug bounty campaigns
[05:41] Changes in CSRF, SQL injection, and information disclosure findings
[07:08] The shift toward stored and blind XSS
[08:51] Signal and duplicate rates across bug classes
[11:14] Reusable bug patterns and name-field injection
[14:13] Identifying outdated browser engines through user-controlled URL fetches
[17:22] Campaign variance and lessons from the report analysis