Researcher Profile: @yvvdwf on Finding Bugs Through the Eyes of an Abnormal User
GitHub has wrapped up Cybersecurity Awareness Month with a second installment of its researcher spotlight series, this time featuring @yvvdwf, a bug bounty participant who balances software engineering by day with security research after hours. In an interview, @yvvdwf discussed their entry into security research, preferred bug classes, and approach to hunting vulnerabilities in GitHub products.
Unlike many researchers who enter the field through formal security training, @yvvdwf's journey began with a single error message in the Git program. A Google search led to a researcher's writeup detailing how the bug was discovered—and the substantial bounty that came with it. That moment sparked the question: "why not try finding a bug!"
From XSS to SSRF: Evolving Bug Hunting Interests
@yvvdwf's first submission was a cross-site scripting (XSS) vulnerability, chosen deliberately because of existing experience with web applications. As the researcher put it, XSS seemed like the easiest way to start the adventure with something already familiar.
Over time, server-side request forgery (SSRF) has become a particular area of interest, especially the DNS rebind attack technique. @yvvdwf finds SSRF compelling because it allows exploring what happens "in the underground of web applications," as well as distributed applications more broadly.
Shifting Mindsets From Developer to Security Researcher
As a software engineer, @yvvdwf normally concentrates on building functional features for typical users. Bug hunting requires a fundamental shift in perspective—acting as an "abnormal user" instead. The researcher notes that most bugs occur under abnormal execution conditions, a reality that can be easy to overlook during development.
Participation in GitHub's program is partly pragmatic: the bounties are attractive, and daily Git usage at work provides relevant experience. With limited time for research, @yvvdwf prefers focusing on a few programs that offer ample room to apply that expertise.
Advice for Aspiring Researchers
When asked about collaboration, @yvvdwf acknowledged not having worked directly with other researchers but emphasized learning through their writeups. Blogging and sharing findings is on the roadmap as a way to give back to the community.
For those seeking a first bug, the key advice is to build a strong background before diving in. "We cannot see the bugs even if they are there" without it, @yvvdwf cautioned. One practical way to develop that foundation: read a writeup, reproduce the bug yourself, then analyze the thought process behind the discovery. Ask what the author was thinking when choosing a particular direction—and what you would have done in their place.
@yvvdwf can be reached via https://yvvdwf.me, which is currently under construction.
GitHub continues to invite security researchers to submit findings through HackerOne, where each report contributes to making GitHub products and customers more secure. The company also points interested candidates to open roles at https://github.com/about/careers.
