Everything you need to know to find your first vulnerability, get paid, and build a real reputation in cybersecurity — without breaking any laws. If you've typed "how to start bug bounty hunting" into Google recently, you're not alone. It's one of the fastest-growing searches in cybersecurity right now, and for good reason: it's one of the only paths in tech where a total beginner with no degree can find a real flaw, report it, and get paid the same week. This guide answers the questions people are actually searching in 2026 — what bug bounty hunting is, which bugs pay the most right now, how AI has changed the game, and how to land your first bounty. What Is Bug Bounty Hunting, Exactly? Companies invite independent researchers to test their websites, apps, and APIs for security flaws — legally. When you find a real vulnerability, you write a report explaining what it is, how to reproduce it, and what damage it could cause. If the company confirms it, they pay you based on severity. It's not hacking in the movie sense. It's structured, permitted testing within a defined scope — the specific domains, apps, or features the company has authorized you to test. Step outside that scope, and you've crossed from "bug bounty hunter" into "unauthorized access," which is a crime in nearly every country. The Best Platforms to Start On in 2026 Three platforms dominate the space: HackerOne — the largest and most beginner-friendly, with the widest range of programs Bugcrowd — strong onboarding and clear scope documentation Immunefi — the go-to platform if you're interested in web3 and smart contract security, which currently pays some of the highest bounties in the industry Start with Vulnerability Disclosure Programs (VDPs) — these often don't pay, but they let you build a track record, earn private invites, and practice on real targets without competing against thousands of other hunters for a bounty. What Bugs Are Actually Paying Right Now The vulnerability landscape has shifte

This is a story of how you receive a higher bill than expected and how GitHub's Billing Controls help clarity and predictability. Let's begin our story. Confusion: The bill is higher than expected The AI bill is higher than expected. Now what? Finance wants to understand what is driving the cost. Engineering leaders, on the other hand, want to preserve the productivity gains behind the increased usage. The administrator needs to balance both priorities and put a policy in place that the business can understand. One question drives the investigation: Where is the increase coming from, and how do we control it without disrupting valuable work? To answer it, we first need to follow the spend. Once we know who owns it, we can apply guardrails at the right level. Investigation: Follow the spend Setting a limit too early could restrict useful adoption without addressing the main source of cost. So, let's find out what changed and who can act on it. The investigation begins in the billing administration portal, where usage and budget settings appear in one place. Fig 01: A unified billing workspace connects usage evidence to budget controls. Identify the consumption category First, we identify which product changed. GitHub reports this by SKU , which simply means the billing category for a product or service. Fig 02: Grouping metered usage by billing category highlights Copilot Enterprise usage. Grouping usage by billing category shows which product is driving the increase. In this example, the chart points to Copilot Enterprise usage. Leaders can then ask whether that growth comes from valuable adoption, an unusual workload, or demand that has outgrown its budget. Locate the accountable organization Once you know which product is driving the cost, find out who owns the usage. An enterprise-wide total can hide a sharp increase in one organization. Fig 03: Organization-level grouping identifies the business unit accountable for demand. The organization view points to the le

It's an alert that comes in as a surprise from BMW - you don't have to click it, but when you do, you are met with a minute long video ad for Spiderman. Submitting as I figured it would be interesting for discussion. Boiling frogs and all.

Poland runs a national e-invoicing system called KSeF (Krajowy System e-Faktur). Business-to-business invoices are submitted to a government API in a schema called FA(3) , and the system hands back an official confirmation of receipt. If you sell software to Polish companies, you will meet it. The Ministry of Finance publishes official SDKs for Java and .NET . There is nothing for JavaScript. A full client is a real project: authentication, session handling, certificates, XML signing. But a large share of rejected invoices have nothing to do with any of that. They are structural. A tax ID with a bad checksum. Net plus VAT that does not add up to gross. A date that does not exist. Those are worth catching on your side, before you build a session with anyone. So I pulled that layer out of a product I work on, rewrote it standalone, and published it: ksef-invoice-validate . Zero dependencies, no network calls, runs in the browser. npm i ksef-invoice-validate import { validateInvoiceForKsef } from " ksef-invoice-validate " ; const result = validateInvoiceForKsef ({ invoice_number : " FV/2026/07/1 " , issue_date : " 2026-07-01 " , seller_nip : " 1111111111 " , buyer_nip : " 1111111111 " , amount_net : 1000 , amount_vat : 230 , amount_gross : 1230 , }); Three things in it were more interesting than I expected. The NIP checksum A Polish tax identification number (NIP) is ten digits. The tenth is a checksum over the first nine, each weighted and reduced modulo 11. const weights = [ 6 , 5 , 7 , 2 , 3 , 4 , 5 , 6 , 7 ]; const digits = cleaned . split ( "" ). map ( Number ); const checksum = weights . reduce (( sum , w , i ) => sum + w * digits [ i ], 0 ) % 11 ; if ( checksum !== digits [ 9 ]) { // invalid } There is a small elegance here. The remainder can be 10, and no single digit equals 10, so those numbers simply cannot exist as valid NIPs. You do not need a special case. The comparison rejects them on its own. This alone catches a surprising amount. Most bad tax IDs in t

INTODUCTION Creating Greenwood academy database is essential for managing the students, subject and exam results efficiently. PostgreSQL, a powerful open-source relational database system, offers the perfect foundation for such a project. The main areas areas in SQL covered in this projects are : 1. DDL (Data Definition Language) DDL commands define, modify, and change the physical structure of database objects like tables and schemas. The first step is to create a greenwood academy schema using the create command. create schema greenwood_academy ; set search_path to greenwood_academy ; Next is to crete tables in the schema; The schema has 3 tables students,subject and exam results. create table greenwood_academy . students ( student_id INT PRIMARY key , first_name VARCHAR ( 50 ) NOT null , last_name VARCHAR ( 50 ) NOT null , gender VARCHAR ( 1 ), date_of_birth DATE , class VARCHAR ( 10 ), city VARCHAR ( 50 ) ); create table greenwood_academy . subject ( subject_id INT PRIMARY key , subject_name VARCHAR ( 100 ) NOT null unique , department VARCHAR ( 50 ), teacher_name VARCHAR ( 100 ), credits INT ); create table greenwood_academy . exam_results ( result_id INT PRIMARY key , student_id INT NOT null , subject_id INT NOT null , marks INT NOT null , exam_date DATE , grade VARCHAR ( 2 ) ); ALTER - This command changes the structure of tables in a database. Core Actions You Can Perform Add columns : Insert a new column and its data type into a table. The school realised that the nthey forgot to add phone numbers in the students table. The following command is used to add the data alter table greenwood_academy . students add column phone_number VARCHAR ( 20 ); Rename colums : Change the name of a table or a column. The column credit has to be changed to credit hours alter table greenwood_academy . subject rename column credits to credit_hours ; Drop columns : Delete an unwanted column from a table. Later the school relised that the phone number column is nolonger needed. a

Hey HN! I wanted to share this OSS project I've been working on. It's called Yap and its a small menu-bar app for macOS that does voice to text for any input. You'll set a hotkey, press it, talk, press it again, and the text gets pasted into whatever field you were in. Everything runs locally and never leaves your computer. Fully OSS and MIT licensed. With macOS 26, Apple recently added two new APIs, SpeechAnalyzer and SpeechTranscriber, that do streaming on-device speech to text using models th

NASA has not made substantial investments in thermal protection research for decades.

A few months ago I got obsessed with a question: can you run a real LLM entirely inside a browser tab, with zero backend, zero GPU, and zero install? The answer is yes. Here's what I built. ghost is a single HTML file that downloads a quantized language model into your browser's cache on first visit, then runs inference locally in WebAssembly forever after. Fully offline after that first download. No API key. No npm. No build step. Open the file, pick a model, chat. How it works The inference engine is wllama — a WebAssembly binding for llama.cpp. It runs GGUF quantized models directly in the browser using WASM SIMD. I pin it to a specific version so the JS and WASM files always match (learned this the hard way after a fun debugging session involving mismatched memory imports). Models are downloaded from HuggingFace on first load and cached via the browser's Cache API. On every subsequent visit they load instantly from cache, no network needed. Features Three models: Qwen2.5 1.5B (smart), Qwen2 0.5B (fast), TinyLlama (lightweight) Markdown rendering from scratch — no library, just regex transforms RAG: drag a .txt or .pdf onto the chat window. It chunks the text, embeds each chunk using wllama's embedding API, stores vectors in memory, and retrieves the top-3 relevant chunks on each message. Fully local, fully offline Voice input via the Web Speech API — mic button auto-sends on silence Multi-turn conversation memory capped at 10 turns PWA installable — works on mobile home screen too The hard parts Getting wllama to load from a cached model was genuinely tricky. Blob URLs created in the main thread aren't accessible from wllama's internal Web Worker. IndexedDB chunk reconstruction hit a 2GB ArrayBuffer limit on Windows Chrome. The final solution was using wllama's built-in loadModelFromHF with useCache: true which handles everything internally. The embeddings API requires toggling a flag (embeddings: true) that conflicts with normal chat completion — so I toggle it

Microsoft bolstered its AI cybersecurity offerings this week with the launch of its first AI security model and a new security platform.

Here's what the rumor mill tells us Google might be preparing for its next Pixel launch.

Apple is facing a lawsuit from three users who say they collectively lost more than $1.8 million after downloading a fraudulent crypto wallet from the App Store, challenging the company’s longstanding claims that its app review process keeps users safe from scams.

Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it. That convenience comes with a catch: the tools, prompts, and schemas an MCP server exposes are a new kind of attack surface, and most traditional scanners simply don't look there. MCPRadar is an open-source project built specifically to close that gap. Why this matters A recent academic study examining nearly 1,900 MCP servers found meaningful security issues in a surprising share of them — general vulnerabilities in roughly 7% and MCP-specific tool poisoning in another 5%. Tool poisoning, prompt injection hidden in tool descriptions, and quietly over-permissioned configurations are easy to miss because they don't look like a "normal" vulnerability — there's no CVE, no obvious buffer overflow, just a tool description that quietly tells an agent to do something it shouldn't. MCPRadar's whole premise is that this class of risk deserves the same rigor as any other part of your CI pipeline. What it actually scans MCPRadar isn't a single-purpose linter — it looks at an MCP server from several angles: Protocol inspection — enumerates tools, prompts, resources, and templates the server exposes, and checks server instructions for suspicious content. Source analysis — walks Python and JavaScript/TypeScript code looking for SSRF, unsafe deserialization, command/SQL injection, Trojan Source tricks, and mismatches between a tool's description and what its code actually does. Configuration review — flags poisoned MCP or agent configuration files, risky hooks, and overly broad permission grants. Supply chain checks — fetches packages without running install scripts, cross-references dependencies against OSV, and can emit a CycloneDX SBOM with hashes and provenance. Change monitoring — stores snapshots in SQLite and diffs them over time, classifying changes as cosmetic, behavioral, or security-relevant so sil

Like a lot of you I hit the 5-hour cap most days. What actually annoyed me was realizing the weekly limit doesn't line up with that. Even capping out daily, I ended every week with quota unused. It expires overnight even after I paid for it. So I built claude-overnight . I queue questions during the day, /queue how do sqlite WAL checkpoints work? right inside Claude Code, and a scheduler runs them at night once my limits reset, through claude -p on the subscription. Morning brings markdown reports and a digest of what ran and what happened. Every job saves its claude session, so overnight resume <id> reopens the conversation that wrote the report. You can argue with it about its conclusions over coffee. Or overnight followup <id> "go deeper on X" and it continues tomorrow night. Coding tasks work too. They run in a throwaway git worktree on an overnight/* branch, only against repos I've explicitly trusted, so the agent never touches my working tree. Morning review is just git diff main..overnight/whatever . Since people will ask how it reads limits when there's no official API: Claude Code stores an OAuth token locally (Keychain on Mac, ~/.claude/.credentials.json elsewhere), and GET https://api.anthropic.com/api/oauth/usage with that token plus an anthropic-beta: oauth-2025-04-20 header returns your 5h and weekly utilization with reset times. Same trick the menubar trackers use. It's undocumented and the response shape already changed once while I was building this, so the tool survives without it. The design constraint I cared most about: don't eat my own morning quota. It won't start above 20% of the 5h window, stops at 60%, skips entirely past 80% weekly, rechecks between jobs. In the morning it opens a page in the browser with the whole batch on it — what ran, how long it took, the resume command for each one, and every report rendered inline so you're not clicking through files half-awake. Check it out at https://github.com/rohanprichard/claude-overnight Curio

Every log has a story خب، روز سوم الان که دارم این لاگ رو می‌نویسم، روز تقریبا تموم شده و امروز از اون روزهایی بود که حس خوبی داشت اگر بخوام بهش نگاه کنم، می‌تونم بگم یکی از روزهای خوب ۱۴۰۵ بود البته امیدوارم بهترینش نباشه چون هنوز کلی برنامه داریم، کلی چیز هست که باید ساخته بشه و کلی روز بهتر قراره بیاد یک پیام غیرمنتظره دیروز ساعت 17:54 یک پیام دریافت کردم راستش آن لحظه خیلی آماده جواب دادن نبودم من معمولا پیام کسی را بی‌جواب نمی‌گذارم، حتی اگر ناراحت باشم یا فاصله‌ای ایجاد شده باشد اما بعضی وقت‌ها آدم نیاز داره سکوت کنه چند دقیقه، چند ساعت یا حتی بیشتر نه برای نادیده گرفتن، فقط برای اینکه بتونه با ذهن آرام‌تر و بی کینه تر جواب بده تایم نهار تصمیم گرفتم بخونم و جواب بدم هر چی نباشه اون کسی بود که موقع اعتراضات حالم رو پرسید حتی وقتی راجع به اون روز جمعه نکبت بار شنید با خطرات اون روزا برای عیادت من اومد ای کاش اون روزا بجای ساچمه تیر میخوردم ای کاش بعد دیدن اون کشتار من هم زنده نمی موندم شاید غریبه باشیم شاید دلخور باشم ولی خب هرگز خوبی ادم ها رو فراموش نمیکنم پیام طولانی بود خیلی طولانی و این دقیقا چیزی است که همیشه دوست داشتم آدم‌هایی که من را می‌شناسند می‌دانند که خودم هم معمولا جواب‌های کوتاه نمی‌دهم به نظرم نوشتن زیاد همیشه به معنی زیاد حرف زدن نیست گاهی یعنی برای توضیح دادن، برای فهمیده شدن و برای احترام گذاشتن وقت گذاشتی و این پیام هم همین حس را داشت نه فقط دفاع از خودت بلکه تلاش برای فهمیدن و توضیح دادن مرور خاطرات بعد از خواندن پیام، چند سال گذشته دوباره مرور شد بعضی آدم‌ها و بعضی روزها، حتی بعد از گذشت زمان، یک گوشه از ذهن باقی می‌مونن سال‌هایی که گذشت از ۱۳۹۹ تا ۱۴۰۲ سال‌هایی پر از تغییر، تجربه و اتفاق‌های مختلف پونه فرزانگان اختیاریه خب خیلی گذشته احساس پیری میکنم سال ۱۴۰۳ ارتباط کمتر شد و هر کسی مسیر خودش رو دنبال کرد تو کنکورت و من هم درگیر درد و دل با این باینری ها بودم اردیبهشت ۴۰۴ اتفاق‌هایی افتاد که شاید بهتر باشه فقط به عنوان تجربه به اون نگاه کنیم نه چیزی که هر روز دوباره مرور شه گاهی گذشته رو نمیشه تغییر داد و خب هممون اشتباه میکنیم بعد دوباره رسیدیم به یک نقطه جدید از ۴فروردین تا ۲۰ اردیبهشت امسال خب بازم شاید همون طوری که امروز گفتی هردو یه