Coverage

Sources

Everything already tracked. Check this list before proposing a source — if it’s here, it’s covered.

tracked

feeds working

feeds broken

manual only

What the labels mean

live: Feed works. The bot checks it daily.
quiet: Feed works, but the source rarely publishes.
broken: Feed URL fails. The bot skips it until someone fixes the URL.
no feed: Worth reading, but has no RSS. Writeups are added by hand.

Research & labs

PortSwigger Researchverifiedlive

James Kettle's team. Original research, consistently top tier.

14 in the archivehttps://portswigger.net/research/rss

ProjectDiscoveryverifiedlive

URL corrected — the old blog.projectdiscovery.io feed redirects here.

6 in the archivehttps://projectdiscovery.io/blog/rss/

Assetnote Security Researchverifiedno feed

Deep vulnerability research on enterprise software — the Craft CMS RCE, the PAN-OS auth bypass, the Next.js middleware bypass. Still publishing after the Searchlight Cyber acquisition, but the old RSS feed (blog.assetnote.io) returns 404 and no replacement feed exists. Worth reading anyway; writeups from here get added manually.

nothing in the archive yethttps://www.assetnote.io/resources/research

Detectify Labsverifiedquiet

Feed is fine, but posts are infrequent.

nothing in the archive yethttps://labs.detectify.com/feed/

Platforms

Intigritiverifiedlive

URL corrected — blog.intigriti.com redirects here. Includes Bug Bytes.

9 in the archivehttps://www.intigriti.com/blog/feed/

Bugcrowd Blogverifiedbroken

Responde 200 pero devuelve HTML en vez de RSS, así que el parser saca cero entradas. Hace falta encontrar la URL real del feed.

nothing in the archive yethttps://www.bugcrowd.com/blog/feed/

HackerOne Blogverifiedbroken

Returns 404. Needs a replacement feed URL — good first contribution.

nothing in the archive yethttps://www.hackerone.com/blog.rss

Researchers

NahamSecverifiedquiet

Ben Sadeghipour. Feed is valid; last post was February 2025.

3 in the archivehttps://www.nahamsec.com/posts?format=rss

Vickie Li Devverifiedquiet

Feed válido, pero el último post es de agosto de 2023.

nothing in the archive yethttps://vickieli.dev/feed.xml

Podcasts

Critical Thinking Podcastverifiedlive

Justin Gardner (Rhynorater) and Joel Margolis (teknogeek). By hackers, for hackers. The feed's <link> field always points at the homepage instead of the episode, so the bot can't dedup reliably and skips this source entirely — add episodes manually with the real URL from criticalthinkingpodcast.io.

3 in the archivehttps://feeds.cohostpodcasting.com/y3zHW5ae

Missing something?

If you follow a bug bounty blog or podcast that isn’t listed, add it. The only requirement is that the author is part of the community or has demonstrable results. Fixing a broken feed URL counts too — it’s the fastest contribution to review.

How to contribute →