HackerOne · April 2026

The first full month running DS-AI on HackerOne: 66 valid reports across 41 programs.

Since April I have been running DS-AI, my own system, against bug bounty programs on HackerOne. I am going to note here how it goes, month by month.

April was the first full month. I ended up with 66 valid reports across 41 programs, counting resolved, triaged and duplicate. The duplicate counts: if the program confirms the bug, it is real, whether or not someone got there first.

Of those, six were critical and seventeen high.

I passed through Booking.com, Spotify, Crowdstrike, Epic Games, Crypto.com, Instacart and Xiaomi, among others. What I found in each I keep to myself: it is under coordinated disclosure.

First month, and the system already delivers against real targets.