0xBugLetter

Community

Contribute

The archive is maintained by the community. Adding a writeup means creating a YAML file and opening a pull request — no code required.

What gets in, and what doesn’t

This is the only rule that really matters, and it’s deliberately strict:

  • Accepted: Writeups by authors known in the community, or with demonstrable results: paid bounties, assigned CVEs, reports disclosed on official platforms.
  • Accepted: Original research from labs and security teams with a track record.
  • Accepted: Podcast episodes and talks with verifiable technical content.
  • Not accepted: “I made $10,000 in a week” posts with no PoC, no public report and nothing backing the number.
  • Not accepted: AI-regurgitated content re-explaining the OWASP Top 10 for the hundredth time.
  • Not accepted: Estimated, inferred or “approximate” bounty amounts. If the number isn’t public, the field stays empty.

Add a writeup

  1. 1

    Create the file

    In data/writeups/, named YYYY-MM-DD-short-title.yaml. The date is the article’s publication date, not today’s.

  2. 2

    Fill in the fields

    data/writeups/2026-07-15-ssrf-example.yaml
    title: "Blind SSRF via PDF export"
author: "@handle"
author_url: "https://twitter.com/handle"   # optional
date: "2026-07-15"
url: "https://example.com/writeup"
source: "HackerOne"

# Classification
bug_type: "SSRF"
severity: "High"
cwe: "CWE-918"                             # optional

# Program
platform: "HackerOne"
program: "Example Inc."                    # optional

# Bounty — only when the amount is public
is_paid: true
bounty_amount: 5000
currency: "USD"

summary: "One or two sentences of your own, not the article's blurb."  # optional

tags:
  - "ssrf"
  - "pdf-export"
  3. 3

    Open the pull request

    CI validates the schema, checks the URL resolves and confirms it isn’t a duplicate. If something fails, the bot comments on the PR with what to fix.

Allowed values

The taxonomies are closed on purpose: if every writeup invents its own category, the filters stop being useful. Adding a value means editing data/taxonomy.yaml and web/src/lib/types.ts in the same PR — the build fails if they drift apart, which is what forces the discussion.

severity

CriticalHighMediumLowInfo

platform

HackerOneBugcrowdIntigritiYesWeHackIndependentVendor VDP

bug_type

XSSSSRFIDORSQLiRCEAuth BypassAccess ControlRace ConditionCSRFOpen RedirectInfo DisclosureBusiness LogicFile UploadXXEDeserializationRequest SmugglingCache PoisoningPrototype PollutionSSTIWebSocketSessionSubdomain TakeoverGraphQLOAuthSAMLLLM / AISupply ChainCloud MisconfigReconMethodology

Add a source

Check the sources page first — if it’s already tracked, there’s nothing to do. Otherwise add a block to data/sources.yaml:

data/sources.yaml
- name: "Source name"
  url: "https://example.com/feed.xml"
  site: "https://example.com"
  category: blog          # blog | platform | researcher | podcast | news
  status: active          # active | stale | broken | no-feed
  verified: true          # known author or organisation?
  note: "Optional context."

Reporting a broken feed counts as a contribution too — and it’s the fastest one to review.