Not every day do I get an email from a very serious security researcher, clearly a man on a mission to save the internet โ one vague, copy-pasted email at a time.
Hereโs the message I received:
From: Peter Hooks <peterhooks007@gmail.com> Subject: Security Vulnerability Disclosure
Hi Team,
Iโve identified security vulnerabilities in your app that may put users at risk. Iโd like to report these responsibly and help ensure they are resolved quickly.
Please advise on your disclosure protocol, or share details if you have a Bug Bounty program in place.
Looking forward to your reply.
Best regards, Peter Hooks
Right. Letโs unpack this.
๐งฏ”Your App” โ What App?
I’m not a company. I’m not a startup. I’m not even a garage-based stealth tech bro. I run a personal WordPress blog. Thatโs it.
There is no โapp.โ There are no โusers at riskโ (unless you count me, and Iฬทฬฬโฬทฬฬ mฬดฬฬช ฬดอฬนaฬธฬฝอlฬตฬฟฬฃrฬธฬฝอeฬตฬอaฬถฬอdฬตฬอyฬดฬฬผ ฬดอฬbฬถฬฬ eฬถฬฬปyฬดออoฬธฬฬฃnฬธฬฬฆdฬดฬฬ ฬถออsฬถออ aฬถอฬกvฬดออiฬตฬอnฬตฬอgฬธฬฬก).
๐ต๏ธโโ๏ธ The Anatomy of a Beg Bounty Email
This little email ticks all the classic marks of what the security community affectionately calls a beg bounty โ someone scanning random domains, finding trivial or non-issues, and fishing for a payout.
Thanks for your email and your keen interest in my โappโ โ spoiler alert: there isnโt one. Just a humble personal blog here.
Your message hits all the classic marks of a beg bounty reconnaissance email:
โ Generic โHi Teamโ greeting โ because who needs names?
โ Vague claims of โsecurity vulnerabilitiesโ with zero specifics
โ Polite inquiry about a bug bounty program (spoiler: none here, James)
โ No proof, no details, just good old-fashioned mystery
โ Friendly tone crafted to reel in easy targets
โ Email address proudly featuring โ007โ โ very covert ops of you
Bravo. You almost had me convinced.
Iโll be featuring this charming little interaction in a blog post soon โ starring you, of course. If you ever feel like upgrading from vague templates to actual evidence, Iโm all ears. Until then, happy fishing!
Cheers, Amedee
๐ข No Reply
Sadly, Peter didnโt write back.
No scathing rebuttal. No actual vulnerabilities. No awkward attempt at pivoting. Just… silence.
โฆitโs probably not the start of a beautiful friendship.
Got a similar email? Want help crafting a reply thatโs equally professional and petty? Feel free to drop a comment or reach out โ Iโll even throw in a checklist.
Until then: stay patched, stay skeptical, and stay snarky. ๐
Paste the comment URL into the search field of your favorite open social app or platform.
Your Profile
Or, if you know your own profile, we can start things that way! Why do I need to enter my profile?
This site is part of the โ open social web, a network of interconnected social platforms (like Mastodon, Pixelfed, Friendica, and others). Unlike centralized social media, your account lives on a platform of your choice, and you can interact with people across different platforms.
By entering your profile, we can send you to your account where you can complete this action.
A โbeg bountyโ is my deliberately informal term for an unsolicited email that invokes the possibility of a bug bounty without actually disclosing a vulnerability.
A legitimate vulnerability disclosure gives the recipient something actionable: what was found, where it was found, how to reproduce it, and ideally the security impact. A legitimate bug-bounty submission does the same, within the rules of an established bounty programme.
The email I received did none of that. It claimed to have found โvulnerabilitiesโ in my โappโ, but provided no vulnerability, affected component, reproduction steps, or evidence. Instead, it asked me to provide my disclosure protocol or tell them whether I had a bug bounty.
That’s why I called it โbeg bounty baitโ: the alleged vulnerability isn’t the information being disclosed; it’s the bait for getting me to engage in a conversation about vulnerability disclosure and potentially payment.
Of course, an unsolicited vulnerability report can be perfectly legitimate, and the absence of a bounty programme doesn’t make a report illegitimate. The distinction I’m making is between reporting a vulnerability and claiming to have a vulnerability in order to solicit a bounty-related response.
There’s another reason I found the email suspicious: it was completely oblivious to its audience.
This is a personal blog, not a SaaS product, web application, or service with โusersโ whose data is apparently at risk. The email referred to โyour appโ, โyour usersโ, and โvulnerabilitiesโ without demonstrating any awareness of what it was actually contacting.
That makes it look much more like a mass mailing than the result of someone investigating my site. The wording is generic enough that it could have been sent to hundreds or thousands of unrelated websites with only the recipient name changed.
I obviously can’t prove whether it was AI-generated, but the combination of generic security jargon, lack of any site-specific technical detail, and the complete mismatch with the target is certainly consistent with an automated โ possibly AI-assisted โ campaign.
Ironically, if you’re going to send unsolicited vulnerability reports, showing that you’ve actually looked at the thing you’re reporting is probably a pretty good place to start. ๐
Remote Reply
Original Comment URL
Your Profile
Why do I need to enter my profile?
This site is part of the โ open social web, a network of interconnected social platforms (like Mastodon, Pixelfed, Friendica, and others). Unlike centralized social media, your account lives on a platform of your choice, and you can interact with people across different platforms.
By entering your profile, we can send you to your account where you can complete this action.
@amedee these guys are so annoying indeed
What is a โbeg bountyโ email and how does it differ from legitimate vulnerability disclosure or bug bounty reports?
A โbeg bountyโ is my deliberately informal term for an unsolicited email that invokes the possibility of a bug bounty without actually disclosing a vulnerability.
A legitimate vulnerability disclosure gives the recipient something actionable: what was found, where it was found, how to reproduce it, and ideally the security impact. A legitimate bug-bounty submission does the same, within the rules of an established bounty programme.
The email I received did none of that. It claimed to have found โvulnerabilitiesโ in my โappโ, but provided no vulnerability, affected component, reproduction steps, or evidence. Instead, it asked me to provide my disclosure protocol or tell them whether I had a bug bounty.
That’s why I called it โbeg bounty baitโ: the alleged vulnerability isn’t the information being disclosed; it’s the bait for getting me to engage in a conversation about vulnerability disclosure and potentially payment.
Of course, an unsolicited vulnerability report can be perfectly legitimate, and the absence of a bounty programme doesn’t make a report illegitimate. The distinction I’m making is between reporting a vulnerability and claiming to have a vulnerability in order to solicit a bounty-related response.
There’s another reason I found the email suspicious: it was completely oblivious to its audience.
This is a personal blog, not a SaaS product, web application, or service with โusersโ whose data is apparently at risk. The email referred to โyour appโ, โyour usersโ, and โvulnerabilitiesโ without demonstrating any awareness of what it was actually contacting.
That makes it look much more like a mass mailing than the result of someone investigating my site. The wording is generic enough that it could have been sent to hundreds or thousands of unrelated websites with only the recipient name changed.
I obviously can’t prove whether it was AI-generated, but the combination of generic security jargon, lack of any site-specific technical detail, and the complete mismatch with the target is certainly consistent with an automated โ possibly AI-assisted โ campaign.
Ironically, if you’re going to send unsolicited vulnerability reports, showing that you’ve actually looked at the thing you’re reporting is probably a pretty good place to start. ๐