// TL;DR
Back when I started in bug bounty in 2017, I found a stored XSS vulnerability in Tumblr. I reported it, the security team patched it the next day, and it turned out to be a milestone finding for me — my first $1000 bounty, along with some swag and a genuinely great response from their team.
Getting started in 2017
I started participating in bug bounty programs in 2017. Like most people new to the field, I was learning as I went — and one of the findings that marked the real beginning of my journey was a stored XSS in Tumblr.
The finding
The vulnerability was a stored (persistent) cross-site scripting issue — the kind where a payload is saved by the application and then executed in the browser of anyone who views the affected content, no per-victim trickery required. That persistence is what makes stored XSS one of the higher-impact variants: the payload simply waits for visitors.
I documented it with a proof-of-concept and submitted it to Tumblr.
The response
The turnaround was fast — Tumblr patched the issue the next day and rewarded the report. It was a milestone for me: my first $1000 bounty, and they also sent over a Tumblr t-shirt and stickers as swag.
Beyond the reward, I had a genuinely great experience with their security team — quick, professional, and communicative throughout, which, as a newer researcher at the time, made a real impression. Working with a team that triages fast and responds well is one of the quiet pleasures of bug bounty, and Tumblr’s was one of the best.
Thanks, Tumblr — and thanks for reading. Happy hacking!
Leave a Reply