> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/useful-resources/bug-bounty.md).

# Bug Bounty

Bug bounty case studies, responsible disclosure notes, real-world PoCs, impact analysis, remediation guidance, and reporting workflows.

Real-world vulnerability research notes and responsible disclosure case studies. This section is for findings that are not CTF writeups and not generic methodology pages: actual reports, PoCs, impact explanations, remediation notes, and lessons learned.

{% hint style="info" %}
Use this section for authorized research only. Keep sensitive tokens, private URLs, customer data, and unreleased vendor details out of public notes.
{% endhint %}

## Case Studies

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-robot" style="color:$primary;">:robot:</i></h3></td><td><h4>GitBook AI Assistant Replay PoC</h4></td><td>Responsible disclosure case study for a fixed GitBook AI Assistant server action replay issue involving entitlement, scope, preview-mode, and session enforcement.</td><td><a href="/useful-resources/bug-bounty/gitbook-ai-assistant-replay-poc.md">GitBook AI Assistant Replay PoC</a></td></tr></tbody></table>

## How To Use This Section

1. Start with the short impact and status.
2. Explain the vulnerable flow without leaking sensitive live data.
3. Separate what was observed from what was inferred.
4. Add a small reproduction summary only when the issue is fixed or safely scoped.
5. Finish with remediation and lessons for future testing.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/useful-resources/bug-bounty.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.