Researcher Finds Cloudflare Turnstile Token Bypass, Denied Bug Bounty Payout

·1 views

A security researcher discovered that Cloudflare Turnstile CAPTCHA tokens can be copied from one browser and reused in another, effectively bypassing the verification system entirely. The bypass required no scripting and was performed manually, making it distinct from automated attack methods. When the researcher reported the flaw through Cloudflare's bug bounty program, the company declined to pay, citing a policy exclusion for automated bypasses. Cloudflare acknowledged the policy wording was vague and said it would be updated, but closed the report without compensation. The researcher noted that Cloudflare appeared to be fixing the vulnerability regardless, raising concerns about how bug bounty programs handle edge-case disclosures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Sub2API Lets You Self-Host a Private AI API Gateway Across Multiple Providers

Sub2API is an open-source tool that allows developers to self-host an AI API gateway, placing a single base URL in front of multiple AI providers and accounts. The gateway handles authentication, routing, usage accounting, and concurrency limits, while issuing separate revocable keys to users or projects. Deployment requires a Linux server running Docker 20.10 or newer, Docker Compose v2, a domain, and at least one authorized upstream API account, with PostgreSQL and Redis bundled in the official stack. The project warns that redistributing quota from AI subscriptions may violate upstream terms of service, and advises keeping initial deployments private using only authorized accounts. Self-hosting becomes worthwhile primarily when managing multiple users or projects, as adding a gateway to a single-user setup can increase system fragility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Defen.so offers developers instant app security with WAF, scanning, and monitoring

A developer named '1fancy' has built and open-sourced Defen.so, an application security layer designed to be installed in seconds via a single CLI command. The tool bundles several security features including a managed WAF, SQL injection and XSS protection, bot detection, DDoS mitigation, and file upload checks. It also provides uptime monitoring, real-time attack logs, and alerts through email, Slack, Telegram, and webhooks. Defen.so includes a security scanner that flags exposed secrets, missing headers, and misconfigured cloud permissions common in rapidly built applications. The project is actively in development and targets developers, startups, and small teams who lack dedicated security infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds multi-agent AI coding orchestrator to keep humans in the merge loop

A developer created agents-concerto, a multi-agent orchestration system built on top of Claude Code, after growing frustrated with opaque AI coding sessions that produced untraceable changes and meaningless green tests. The system uses a conductor-and-players model where separate agents handle implementation, classification, and review, with strict rules preventing any code-writing agent from also approving or merging changes. All acceptance criteria are written in Given-When-Then format at the planning stage and must translate into tests that assert only observable behavior, never internal implementation details. Each agent operates in its own isolated git worktree, and the system caps review-fix cycles with a human exit option once the limit is hit. The orchestrator's sole output is a pull request ready for human review, with auto-merge explicitly excluded and merge permissions never requested.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Price Monitoring Bot Using Python and Telegram

A tutorial published on DEV Community walks developers through creating an automated price monitoring bot using Python and the Telegram messaging platform. The bot is designed to track product prices on websites and notify users via Telegram whenever a price drop is detected. Developers are guided to set up a Telegram bot through BotFather, obtain an API token, and install required Python libraries including python-telegram-bot, requests, and BeautifulSoup4. The bot works by sending HTTP requests to product pages, parsing the HTML to extract price data, and comparing it against previously recorded values. Sample code is provided throughout the tutorial to help developers assemble the full working bot step by step.

0 comments Read more at DEV Community