Reported my first Bug Bounty finding

Bug Bounty Hunting Journey – First Steps

🎯 Initial Target

I found a target where users could publish their own stores from a CMS.

During testing, I discovered that it was possible to inject JavaScript inside the JSON template.

📝 Report

I responsibly reported the vulnerability to the program.
This morning, I received a reply — unfortunately, someone else had already reported the issue.

💡 Reflection

Even though I didn’t get the bounty this time, I’m still really happy:

• ✅ Discovered a valid XSS vector inside JSON templates
• ✅ Learned how to test and confirm template-based injection
• ✅ Got hands-on experience with responsible disclosure

🔎 Next Steps

I’ve just started enumerating subdomains for the target:

• Already found a few interesting ones
• Many more still left to investigate

I’ll keep going and continue the adventure into subdomain enumeration and deeper recon. 🕵️‍♂️✨