Sirat Sami

An uncapped PDF export let a single low-volume attacker degrade HackerOne's global response times — and nearly didn't get rewarded for finding it.

The rate limiter counted `/login` and `/login/` separately while the application routed both to one handler—doubling permitted authentication traffic from a single IP.

A Slack Connect provisioning path silently enabled approved-domain signup on new workspaces, exposing supposedly isolated collaboration spaces to unintended insiders.

A routine Skybrute test uncovered a public 4GB enterprise Slack backup spanning ten years—and the affected team closed the exposure within 30 minutes.

An unverified identity and an invitation token that was not bound to its recipient combined into vertical privilege escalation and workspace takeover.

Two different concurrency bugs broke the same identity guarantee: one raced an invitation against an email change, while the other applied a valid token to the wrong active address.

An expired domain can outlive its ownership inside an enterprise signup allowlist, turning an abandoned DNS asset into a trusted workspace identity.

Two role changes pushed a pending Slack invitation into an active-member state—joining a user to a workspace without acceptance or consent.

What began as HTTP request-smuggling research exposed a far simpler fail-open proxy rule: omit one header and the protected administrative login appeared.