Reporting vulnerabilities to Y Combinator backed companies
March 16, 2025
spent a friday night thinking differently about how users interact with applications. sometimes the most interesting discoveries come from questioning the assumed boundaries of user behavior.
in total reported vulnerabilities to 6 different YC-backed companies, helping secure their infrastructure and protect user data.
thinking differently
most users follow the paths laid out for them - clicking buttons, filling forms, following the expected flow. but what happens when you start questioning these boundaries? when you begin to see the application not as a user, but as a curious explorer?
the interesting patterns emerge when you observe how systems respond to the unexpected. it's in these edges - these uncharted territories of user interaction - where you find the most intriguing behaviors.
reflection
sometimes finding vulnerabilities isn't about sophisticated techniques - it's about the willingness to try things others haven't thought of. it's about seeing patterns in server responses that tell a story about what might be possible.