Bug bounty & application security
YouGina
Software engineer. Security researcher. Curious by nature.
I build software, take it apart, and investigate how it can be broken. My interests lie at the intersection of software development and application security, with a focus on finding vulnerabilities and understanding what makes them exploitable.
What I work on
Three threads run through everything on this site: hunting for bugs, understanding why they exist, and building the tools that help me do both.
Bug bounty hunting
Access control mistakes, business logic flaws and my all-time favourite; SQL Injections, in web applications and APIs, and the write-ups that make a finding reproducible for somebody else.
Vulnerability research
Reading source code to find the root cause instead of the symptom: how a parser, a permission check or a cache really behaves, and what that means for everything around it.
Tools and engineering
Small scripts I build while testing, gadgets to make my live easier or something that helps me get just that one step further then when I would have had to do it manually.
What this site is for
Through bug bounty hunting, source code analysis, and hands-on experimentation, I explore real-world security issues, develop tools, and share what I learn along the way.
My goal is not only to explain what I found, but also why it works and what others can learn from it. Most pieces start as notes taken during a test, and grow into something worth reading.
I believe the best discoveries come from curiosity, critical thinking, and a willingness to look beyond the obvious.
Recent writing
This site is where I document my research, publish technical write-ups, and share tools and techniques. Everything here is published after disclosure or with the permission of the programme that received the report.
Hack the Hague 2026
Hack the Hague 2026: a bug hunting experience covering reconnaissance, source code analysis, WordPress security research, and adapting my approach throughout the day.
CVE-2025-8083 - Prototype Pollution in Vuetify
Back in July of 2025 I found an interesting vulnerability in Vuetify's Preset configuration. In this article I give a technical overview of this bug, following the style of my original report.
Reflecting on 2025 and setting bug bounty goals for 2026
Just like last year, this is a reflection on my bug bounty journey with insights from the Critical Thinking podcast and my article from previous year.
Always happy to compare notes
If you are working through a finding, want a second opinion on a disclosure, or have a tool worth testing, write to me. I read everything, and I answer research questions first.
YouGina
Software engineer and security researcher. I write about bug bounty hunting, application security, and the craft of building software that is harder to break.
Get in touch
@yougina
For research questions, disclosure conversations, or a second opinion on something you are working through.