#vulnerability

I Hacked BellaBot and Every Robot from China's Biggest Robotics Company (Pudu Only Fixed It When I Told Their Clients)

Critical vulnerabilities in Pudu Robotics allowed unauthorized control of every Pudu Robotics Robot worldwide. They ignored emails until I contacted Skylark Holdings and Zensho about their compromised robot fleets.

bobdahacker blog · EN

Taimi: Finding Everyone's Private Photos Was Easy, But So Was Getting Paid

How I found critical IDOR vulnerabilities in Taimi that exposed "expiring" videos, private photos through a bizarre location feature, and allowed fake system messages - and how they actually handled it right with a $10k bounty.

bobdahacker blog · EN

Bandsintown: How I Almost Rickrolled 191k People

How I found a verification bypass in Bandsintown that let anyone claim unclaimed artist pages with a single API call - including Rick Astley's 191k followers, their emails, and the ability to send push notifications as any artist.

bobdahacker blog · EN

Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks

How I found critical vulnerabilities in Petlibro smart pet feeders allowing complete account takeover via broken OAuth, access to anyone's pet data, device hijacking, and private audio recordings - and how they're still leaving the auth bypass active for 'legacy compatibility' two months later.

bobdahacker blog · EN

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

bobdahacker blog · EN

Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.

bobdahacker blog · EN

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later. Nobody has ever responded.

bobdahacker blog · EN

tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.

bobdahacker blog · EN

GitLab Orbit: Find vulnerability blast radius without the manual hunt

A critical vulnerability needs a fix and a map. The fix is usually fast. Finding where the vulnerable component lives, who owns it, and whether it's exposed to the Internet is what costs you time. Most security teams piece that answer together from scanner reports, spreadsheets, and a Slack thread asking who owns a service nobody recognizes, and you stay exposed for every hour that takes. GitLab Orbit , now generally available , replaces this manual work with a single query. Orbit connects code, merge requests, pipelines, security findings, and ownership in one graph that stays current as your

GitLab · EN