A Letter from a Student in India: Curious About Bug Bounty? Let's Talk

A while ago, I got an email from a computer science student in India. He said he'd found me through my Intigriti profile.

It wasn't long, but it was sincere. He likes low-level and OS-related stuff and enjoys writing C, but when it comes to finding CVEs, he's a complete beginner.

He asked three very specific questions: how I got started researching Trusted Firmware, how I usually go about finding places that might have security issues, and what level of PoC the program typically expects to see when you submit a report.

What stuck with me most was the line he opened with: "If it's not rude to ask."

First, a bit of context on why he reached out to me.

In January this year, I reported a security issue in Trusted Firmware-A through Intigriti. It was later included in the official TFV-15 security advisory and assigned CVE-2026-34878.

In short: before verifying an image, the bootloader first reads the table-of-contents information in the firmware package to work out where each piece of data lives and how big it is. The checks on that information weren't thorough enough at the time, and under certain conditions this could leak data from secure memory during boot, or cause the boot to abort.

What stuck with me about this bug is that even if signatures get verified later, the parsing steps that come before that still need proper security checks.

That record is probably why he came to me.

But as I was writing back, I realized that the three things he asked about—how to get started, how to find issues, how far to take a PoC—come up just the same if you're researching web apps, WordPress plugins, or some API. The technical details differ, but the questions you have when you're just starting out are remarkably similar.

The email also made me think that maybe there are people in Taiwan with the same questions who just don't know who they could talk to.

So I want to use this chance to make the invitation clear: if you're in Taiwan and you're interested in bug bounty, finding CVEs, or security research, you're very welcome to reach out and chat.

You don't need to work on firmware, you don't need to know low-level stuff, and you definitely don't need a CVE or a bounty payout under your belt before you ask. Whatever area you're exploring, or even if you're just curious and don't know where to start yet, that's fine. For example:

• You don't know which target or which platform to start with.
• You found something suspicious, but you're not sure whether it counts as a vulnerability or whether it's worth reporting.
• You're not sure how to write the report, or what your PoC needs to show to be clear enough.
• You can't quite make sense of a program's scope and rules.
• Or you just want to know what doing security research and taking part in bug bounty programs is actually like.

I've been stuck on plenty of these myself. Some of them don't look complicated in hindsight, but at the time they took me quite a while to figure out.

What I can share is how I got started, where I took detours, and what I've learned about reporting and communicating with programs. If any of that happens to help you figure out your next step, it's well worth a conversation.

Back to that line: "If it's not rude to ask."

I know that hesitation well. You feel like you have to read enough first, get good enough, or at least build something before you're allowed to ask anyone. And when you don't even know how to describe your question yet, it's even harder to speak up.

But when you haven't figured something out yet, it's naturally hard to ask a polished question. You can start by telling me what you're trying to do and where you're stuck; if you've already tried a few things, write those down too, and we'll start the conversation from there.

So don't worry about whether it's rude to ask. Just ask.

It's free. I just want to get to know people who are interested in security research and share some of what I've learned along the way. If you'd like to chat, just email [email protected]. No need for pleasantries or a long lead-in; just write about whatever you want to talk about.

The door's open. Come say hi anytime.