This is the reading entry point for the `Bug Bounty from Zero` series (parts 0–14). Each post covers one decision in plain language, backed by verifiable official sources, for readers with no security background.
Replay the control, then change one field; a status code or reflected text alone is not vulnerability proof.
A TEE is a hardware-isolated execution environment meant to keep even the machine's operator from seeing what runs inside; remote attestation lets an outsider verify which program is running in that room. WhatsApp's Private Processing uses it for AI summaries. Meta's bounty page lists code execution (including bypassing code attestation), privilege escalation and VM escape at up to $300,000 each, data leaks at $150,000 and persistence at $10,000, invitation only, with lower caps for internal-only scenarios. Trail of Bits' review found 28 issues, 8 of them high severity, which shows the hard part of TEEs is implementation detail, not the concept.
AI bounty pages mostly do not pay for what a model says (jailbreaks, hallucinations, harmful output). They pay when a model is made to act against someone else (actions and data theft through indirect prompt injection), and for ordinary bugs in the software around it. Google's AI VRP base rewards run from $100 to $20,000; OpenAI's Safety Bug Bounty ranges are $250 to $7,500 per report. Rules as read on 2026-10-14.
Google multiplies the reward by 0.8, 1 or 1.2 depending on report quality across seven dimensions, and only counts what you provided before triage; later additions usually do not change it. Write to a one-page template (title, summary, preconditions, steps, impact, fix suggestion), then estimate hourly expected value as probability x amount / hours. A bigger ceiling can still lose to a small payout once the odds are low enough. Only Resolved is guaranteed to pay; duplicates and invalid reports are common. Every probability and hour count in this post is an assumption, not a statistic.
Finish a reproducible practice report, identify your gaps, then choose a course or credential; certification does not authorize testing.
Read payouts with their product, category, threat scenario and evidence requirements; program ceilings and quality rules are not interchangeable.
Read rules through four questions: what may I test, which reward conditions apply, which actions are excluded, and how must I report? A listed asset does not authorize every method or guarantee a payout.
A browser sends a request with a method, target, headers, and sometimes cookies. The server returns a status, headers, and content. Authentication identifies a user; authorization must still check access to each order.
XSS happens when a site puts user input into a page unchanged, so another person's browser runs it as code; the fix is escaping on output. IDOR happens when a server hands over whatever id it is asked for without checking the record is yours; the fix is an ownership check on the server. Google's table puts XSS under 'execute code on the client' (C0), $10,000 base on a standard Google app, and IDOR under logic flaws (S2), priced by how sensitive the exposed data is: on the same standard Google app, $3,133.7 to $31,337.
RCE means an outsider can make someone else's machine run code. In Google's table, for a normal *.google.com app, RCE has a $75,000 base reward against $10,000 for XSS. The two beginner paths are user input glued into a shell command and deserializing untrusted data; the fixes are argument lists and JSON.
Once a program is loaded into memory, the CPU runs it by following an address that says where it is now; each function call leaves a return address on the stack, a note saying where to go back to. A small C program that prints addresses lets you check this yourself.
A buffer overflow is data written past the space set aside for it, clobbering whatever sits next door. In the demo, one extra character in a name turns is_admin from 0 into 65; the fix is a length check plus a length-limited function. Canaries, ASLR and NX are extra layers, not guarantees, and AddressSanitizer catches an overflow of a standalone array but, in my test, missed one between fields of the same struct.
A hypervisor is the software layer between hardware and several operating systems that gives each virtual machine its own isolated execution environment. MSRC's Hyper-V bounty table splits guest escapes into L1 (up to $250,000) and L2 (up to $150,000); the difference is which wall gets crossed.
Backprop is not new math; it computes the part of the chain rule that every layer shares exactly once. For a linear layer the forward pass multiplies by W, the backward pass multiplies by W transposed, and the weight gradient is 'input times the gradient coming back'. Gradients add at a branch, so shared parameters add their gradients too. A hand-computed update on a 2-2-1 network at the end takes the loss from 0.0175 to 0.0076.
Neither parameter count nor VC dimension explains generalization in deep nets: a network can memorize random labels to 100%, which makes the VC bound vacuous, and past the interpolation threshold test error falls a second time as parameters grow. Isola's account is that there are pressures beyond fitting the data, and he considers architectural symmetry and compositionality the most important. The question is still open.
A generative model plus its latent space works as data you can operate on: moving along a latent direction yields counterfactual images, and a handful of manual labels expands into a whole segmentation dataset (one labeled GAN image is worth about 100 ordinary labeled images). But representations trained on generated data still trail real data (42.6% against 43.9% in the numbers cited in class), and rare classes are exactly where generators are least reliable.
Test loss follows an approximate power law in data, parameters and compute, but the exponents are small: Kaplan et al. measure a data exponent of about 0.095, so doubling the data lowers the loss by only 6% and halving it takes over 1,400 times more. Two papers disagree on how to split compute: Kaplan gives parameters ∝ C^0.73 and data ∝ C^0.27, Chinchilla about half each. The public recording stops at the second finding; everything after that is written here from the slides, without the lecturer's spoken explanation.
A language model does one thing: given the preceding text, output a distribution over the next word. At large enough scale, the way to control it becomes changing the input: a few examples (in-context learning), or asking it to write its reasoning first (chain-of-thought; the example cited in class is one sentence, Let's think step by step, taking an arithmetic task from 18% to 80%). But following instructions and saying 'I don't know' do not come from next-word prediction alone; instruction tuning and RLHF add them.
Gradient descent silently assumes the weight space is Euclidean, and for neural networks it mostly is not. Bernstein's approach picks a norm for each layer (a shape-rescaled spectral norm for linear layers) and computes a norm for the whole network from two combination rules; normalize updates in it and the optimal learning rate stops drifting with width and depth. Push the same idea to duality maps and a linear layer's update becomes 'set every singular value of the gradient to 1', which is also what the nanoGPT training speed record of the time used.