Rejected but Rewarded — What a GraphQL Misconfiguration Taught Me About Bug Bounty Triage. Responsible disclosure submitted. No mutations were executed. No systems were harmed. Finding classified …

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

A bug bounty researcher shares a story of finding an exposed GraphiQL IDE and enabled introspection on a production system, initially scoring it CVSS 9.1. The triage team rejected it as 'Informative' because the visible mutations were protected server-side — anonymous users couldn't actually execute them. Key lessons: schema visibility doesn't equal exploitability, CVSS scores should reflect demonstrated impact not theoretical access, and misconfigurations without confirmed CIA impact rarely qualify for bounties. The researcher received a 50 CHF courtesy bonus, acknowledging the real (but non-exploitable) misconfigurations of public GraphiQL and enabled introspection in production.