If ByteDance is listening: A clear rewards framework for CapCut would attract top talent before attackers find the low-hanging fruit. 🍍
Before I disclose: Is there a private HackerOne/third-party program, or are we going straight to VDP? 👀 capcut bug bounty
I've found: 🔹 Auth bypass in the web editor 🔹 Insecure direct object references (IDOR) in project files 🔹 Rate-limiting gaps on the mobile API If ByteDance is listening: A clear rewards framework