Bug Bounty Paydays

PAID TO BREAK IT — Issue #1: Five Disclosed Payouts Dissected

Five real disclosed bug-bounty payouts from 2025–2026 — a $24,000 Meta OAuth chain, a critical SSRF in HackerOne's own platform, two IDOR/BOLA findings (one paying $15,000), and a WAF documentation flaw — each broken down by vuln class, program, and the skill ladder a beginner needs to get there.