As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team is excited to spotlight another top-performing security researcher from the GitHub Security Bug Bounty Program: @r31n!

As home to the world’s developers, GitHub is dedicated to the security and reliability of the code behind millions of projects, and our Bug Bounty Program remains a cornerstone of that commitment. Collaboration with external researchers is one of the most effective ways to improve security, and every year, the community helps us identify and fix vulnerabilities that make the platform safer for everyone.

The security research landscape is changing rapidly. AI has lowered the barrier to entry and become a genuine force multiplier. We use it across our own internal security programs, and we welcome researchers who do the same. However, what separates great research has not changed: validation, a working proof of concept, and a clear demonstration of real security impact. The tools do not matter; the quality of the work does. The researchers we spotlight this month exemplify exactly that standard through findings that are verified, reproducible, and demonstrate that a security boundary has been crossed rather than simply theorizing that one exists.

Researchers who consistently work at that level can earn an invitation to our permanent VIP program, which offers higher payouts, faster response times, and early previews of beta products and features. Learn more about how to qualify on our public bounty site.

As we wrap up our Cybersecurity Awareness Month celebration, we interview @r31n, a researcher renowned for their work on GitHub Enterprise Server, where they have repeatedly uncovered high-impact issues. Their reports consistently include working proofs of concept and clear reproduction steps, helping our engineering teams move from triage to remediation more quickly.

How did you get started in security and bug bounty, and what keeps you coming back to GitHub’s program?

I got into bug bounty because I wanted a way to keep developing my security skills outside the environments I work with every day. It exposes me to different products, technologies, and architectures I probably wouldn’t run into otherwise. GitHub is one of those programs I keep coming back to because there’s just so much surface area. It’s large, complex, and constantly changing. New features ship all the time, so it never really feels like a finished target. They also work closely with researchers, the bounty structure is competitive, and the swag is a nice bonus. It’s simply a program I enjoy spending time on.

What are your favorite classes of bugs to research and why?

I don’t really have one favorite bug class. What interests me more are exploit chains, especially cases where a few things that seem relatively harmless on their own come together and create something much more serious. An open redirect is a simple example. By itself, the impact might be limited. But if you find an allowlisted-domain SSRF that follows redirects, suddenly that open redirect can become a useful part of a much bigger chain. That’s probably the part of vulnerability research I enjoy most: finding those connections, looking at two or three separate bugs and realizing they can be combined in a way that wasn’t intended. It takes some technical knowledge, but also quite a bit of creativity.

How do you keep your skills sharp and stay on top of new vulnerability trends?

It’s actually a mix of different things. Security blogs, vulnerability write-ups, conference talks, proof of concepts, research papers, courses. I try to learn from wherever useful work is being shared. But most of it only really sticks once I try it myself. I can read a vulnerability write-up, but working through it myself gives me a much deeper understanding. If I actually reproduce the technique, play around with it, break it, and figure out why it behaves the way it does, that’s when it really stays with me. And later, when I see a similar pattern on a real target, it’s much easier to recognize.

What tools or workflows have been gamechangers for your research? Any lesser-known utilities you’d recommend?

I tend to prefer manual investigation and small, purpose-built scripts over large automated toolchains. If I notice I’m repeating the same task during research, I’ll usually automate that specific part. AI has probably impacted my way of working more than any individual security tool.

Even then, I think mindset matters more than tooling. You can become extremely good with a particular tool and still miss interesting bugs because you’re only looking at the target through the lens that tool gives you. Sometimes relying too heavily on tooling actually narrows the way you think. Tools change. Techniques change. Curiosity and persistence tend to age much better. So, I don’t really have one tool I’d recommend to everyone. The most useful tool is usually the one that helps answer the specific question I’m investigating.

Walk us through your general approach. How do you pick a target area, and how do you go from “interesting feature” to a confirmed finding?

I usually start by mapping out the application and getting a feel for how its different parts fit together. I tend to spend more time on complex functionality, integrations, trust boundaries, and anything that behaves a little differently from the rest. Experience and intuition matter too. Some areas simply look more likely to expose interesting security behavior. From there, I often think in terms of sources and sinks rather than starting with a specific vulnerability class. A source is a point where attacker-controlled data enters the application.

Think of a request parameter, uploaded file, API input, or data coming from another service. A sink can be a security-sensitive operation that consumes this data, for example, a network request, file access, process execution, database query, or authorization decision. The interesting part is tracing the path between the two. I look at how the data is transformed, validated, or passed across trust boundaries, and whether those controls are sufficient before it reaches the sink.

I like this approach because it lets me reason about attack paths without forcing my investigation into a predefined bug class. Sometimes the vulnerability only becomes obvious once you understand how a particular source can influence a security-sensitive operation. I consider a finding confirmed once I understand the attack path, can produce a working PoC, and can explain the impact.

Do you use AI in your research? Where does it genuinely help and where does it fall short?

Yes. Quite a lot, actually, but mostly as an accelerator. I use it for navigating unfamiliar code, finding call sites, tracing data through the codebase, and understanding how a system is structured and how its components interact. I also find it helpful for writing PoC scripts once I’ve identified the vulnerability.

Where it works best is when the question is specific. “Is this application vulnerable?” usually isn’t a very useful prompt. Give it the right context, explain what you already know, and ask a narrow question, and the quality goes up dramatically. There’s a bit of a paradox there. AI becomes more useful as you understand the problem better yourself. And I never treat its conclusions as facts. Hallucinations, false positives, bad assumptions, and confidently wrong answers are all common. Everything should still be manually verified. AI makes my work faster. However, it doesn’t replace understanding the application, developing intuition, or proving that something actually works.

What’s your guidance on using AI responsibly in bug bounty?

Use it to improve your research, not to outsource responsibility for it. If AI tells you it found a vulnerability, that doesn’t mean you found a real vulnerability. You still need to reproduce it yourself. You should understand exactly what’s happening, which security boundary or control is being violated, and what the real impact is. Ideally, you should understand the issue well enough that you could write the report without AI at all. Build a clear PoC. Make sure the security team can follow it. Know why every step matters.

AI has lowered the barrier to doing security research, which is great in a lot of ways. But you can also see the downside in the number of unverified reports teams now have to deal with. AI should make research better. Not just make more reports.

As the industry ships more AI-powered features, does testing them require a different mindset than traditional web bugs?

Yes. Conventional vulnerabilities still matter, but attackers may also be able to influence a probabilistic decision-making component through the data, instructions, or context it receives. But getting a model to say or do something unexpected isn’t necessarily the interesting part. The more important question is what that influence allows an attacker to achieve. Can they access something they should not or cause the system to act with privileges the attacker does not have? That’s why I don’t think model-level guardrails should ever be treated as the only or primary security boundary. You still need deterministic controls around the model. This includes proper authorization, least-privilege access, isolation, and validation. The surrounding systems matter just as much as the model itself. And traditional application security doesn’t disappear just because AI is involved. Model output should still be treated as untrusted input. If that output ends up in a browser, database query, shell command, web request, or another downstream system without the right controls, you can still end up with very familiar vulnerabilities: XSS, SQL injection, command injection, SSRF, and so on. I think the model is new. A lot of the dangerous sinks aren’t.

What’s one thing you wish you’d known when you first started?

Learn systems, not checklists. When I started, I was tempted to collect huge lists of techniques, payloads, tools, and bypasses and then work through them one by one. Those lists can be useful.

I still use them. But understanding how a system works has been far more valuable. Its internal logic. The data flows. Trust relationships. Assumptions. Why one component is allowed to talk to another. Why a particular restriction exists in the first place. I also learned not to assume something is secure because it looks secure, or because plenty of researchers have already tested it.

A lot of interesting research begins with: “Why does this work this way?” rather than “Which payload should I try next?” There’s some luck involved too. Sometimes you spend days following something that goes absolutely nowhere. Then you notice one tiny detail almost by accident and it turns into a high-impact finding. You can’t control that part. You can control whether you keep questioning things long enough to notice it.

What advice or resources would you recommend to researchers trying to land their first valid report?

Get comfortable with the fundamentals, then pick one program and one target and stick with them for a while. Constantly jumping between targets makes it difficult to build a real mental model of any of them. Use the application. Explore weird flows. Test different roles and permission levels. Read the documentation. Watch the requests and responses. Look at the APIs. Labs, courses, public write-ups, disclosed bug bounty reports, and intentionally vulnerable applications are all useful too. They teach you where bugs tend to hide and, over time, help build the intuition to recognize similar situations elsewhere.

One mistake I see a lot is relying on tools too early. Another is giving up because the obvious tests didn’t find anything. Tools help. They don’t build the mental model for you. And when you finally do find something, spend the extra time validating it properly. Create a working PoC. Make reproduction easy for the security team. Understanding one target deeply will usually get you further than trying to find a bug as quickly as possible.

What do you enjoy doing when you aren’t hacking?

Endurance sports, mainly road cycling, especially in the mountains. I enjoy the physical challenge of a long climb and pushing myself over longer distances. It’s also a great way to get away from screens for a while and spend some time outside. There’s actually something about climbing that feels pretty similar to vulnerability research. You can put in a lot of effort without seeing much progress. Sometimes you have no idea whether what you’re doing is going to lead anywhere. You just keep going. And every now and then, it pays off.

Any social media profiles you’d like to share with our readers?

You can find me on HackerOne.

Thank you, @r31n, for participating in GitHub’s bug bounty researcher spotlight! Each submission to our bug bounty program is a chance to make GitHub, our products, and our customers more secure, and we continue to welcome and appreciate collaboration with the security research community. So, if this inspired you to go hunting for bugs, feel free to report your findings through HackerOne.

The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog.

Microsoft has released PowerToys 0.102 with two new mouse utilities, Mouse Button Lock and CursorHide, plus several other updates.

The post PowerToys 0.102 Brings Two New Utilities, Other Updates appeared first on Thurrott.com.

1Password for Agents is a new platform for securing AI agents that use your passwords and other credentials to get work done on your behalf.

The post 1Password for Agents is Now Available appeared first on Thurrott.com.

The people and institutions closest to a community understand their needs best. Libraries, small businesses, nonprofits, and schools see firsthand where AI can create opportunity and where people need support to navigate change. At Microsoft, our role is to help these trusted institutions lead by providing practical resources, training, and clear safeguards that strengthen local capacity and put communities at the center of AI literacy and adoption. 

Public libraries have served as trusted centers of community learning across the United States for generations. Today, we are announcing a new initiative with the Public Library Association, a division of the American Library Association, to expand resources and no-cost AI literacy and skills training for public library workers and their patrons.  

This work delivers on the commitment we made earlier this year through our Community-First AI Infrastructure initiative: to expand access to AI learning and opportunity by investing directly in local training. We’re committed to neighborhood learning through libraries, free literacy training, and certification opportunities, age-appropriate learning in schools and colleges, and support for nonprofit and small-business workforces. This new library initiative is the latest example of our broader work to help trusted local institutions serve as entry points for AI learning, skills development, and opportunity. This program comes alongside small business accelerator programs in TechSpark, our new Elevate for Changemakers platform connecting nonprofits to resources, and our ongoing national and statewide work to bring safe and responsible AI to education. 

Local libraries lead AI learning in their communities 

The Public Library Association AI literacy initiative we are announcing today, Building AI Skills and Agency Through Libraries, is designed to build practical skills, critical awareness, and the judgment to use AI safely and appropriately. It will pair Microsoft’s AI skilling resources with PLA’s national network of expert practitioners to support library workers and community patrons as they navigate this rapidly evolving technology.  

The initiative will expand practical resources and training for library workers, create opportunities to learn from one another through a Community of Practice, and offer free webinars and guidance to support their work with patrons.  

Library workers help people navigate information, find learning resources, and make informed decisions for themselves and their families. Supporting those workers is a practical way to bring AI learning closer to people, while respecting the independence of the institutions they trust. 

The approach reflects a broader view of AI literacy: people need more than instructions for using AI tools; they also need the knowledge and judgment to decide whether, when and how those tools should be used. The training will help library workers and patrons understand how AI works and expand their skills, while also evaluating potential risks, protecting personal and confidential information, critically evaluating AI-generated claims and sources, and better understanding considerations related to safety and bias.   

Equipping trusted local institutions to lead responsible AI adoption 

Last July, we launched Microsoft Elevate, a company-wide initiative that brings together our work to help people and institutions build the skills and capacity to navigate AI responsibly. Under the Elevate charter, each year, Microsoft supports nearly one million nonprofit organizations and education systems worldwide with technology, training, grants and discounts. Microsoft Elevate for Educators, our global community of over 100,000 teachers and school leaders, recently recognized our inaugural group of 20 Beacon Schools and School Systems that are leading examples of AI transformation in education, bringing together effective AI practices while keeping educators and students first. They are powerful examples of what happens when you combine committed educators, AI-powered technology, and intentional, no-cost staff training.

In Washington, our Elevate commitment has included a $3 million, two-year investment supporting 10 school districts and 10 community and technical colleges with grants, coaching, and communities of practice. To date, the initiative has reached 29,375 educators, with early pilots in Kennewick and Everett helping teachers explore practical uses of AI while keeping professional judgment at the center. 

Skills and access must be matched by strong safeguards. In September, Microsoft joined the American Federation of Teachers to establish a national AI Safety & Privacy Standard for Schools, with enforceable protections for student and educator data, human oversight, and transparency for families. Beginning November 1, every US school district can request Microsoft to add these protections to a new or existing agreement, without waiting for renewal or renegotiation. 

That same commitment extends to nonprofit staff and leaders. The Elevate for Changemakers program has already supported over 18,000 learners, helping them build practical AI skills, connect with peers, and earn recognition for turning learning into tangible outcomes for their organizations. And today we are expanding the program and introducing a new, connected experience that brings training, resources, and community together.  

Together, these efforts reflect a simple principle: responsible adoption requires more than technology. Educators, nonprofit changemakers, and community leaders need time, training, trusted connections, practical support, and clear guardrails so they can decide when AI strengthens learning and, equally important, when it does not. 

Investing in locally led economic opportunity across all 50 states

For nearly a decade, Microsoft has partnered with local nonprofits and small businesses across the U.S. through our TechSpark program. 

Through Fellows grants, TechSpark pairs local expertise with Microsoft coaching and a national peer network to help nonprofits expand their impact in their local community and drive accelerated innovation for local small businesses. Today, Microsoft is announcing the new 2027 TechSpark Fellows across all 50 states and releasing the 2026 Fellows Impact Report showing what a locally led model can make possible.  

Over the last three years, the Fellows cumulatively report access to more than $298 million in community funding, 59,600 people trained and upskilled in AI literacy, and more than 1,500 nonprofit partners mobilized to advance their missions within their communities. These numbers tell an important story: no single organization can create lasting opportunity on its own, and local context matters.  

In Virginia, Rosie Riveters Executive Director Brittany Greer is showing what it looks like to build the human capabilities that innovation requires. Through hands-on STEM experiences, students build, test, and troubleshoot to develop the critical thinking, persistence, and independent judgment they will need to use AI thoughtfully. Her work is the kind of learning these partnerships are designed to strengthen.  

Community institutions know their neighbors, understand the barriers they face, and are best positioned to decide how new resources can serve them. 

An ongoing journey

The thread connecting a library worker, a job seeker, a TechSpark Fellow, and a teacher is not a particular product. It is the ability to make informed decisions with support from people and institutions they trust. Our responsibility is to make that support more useful, accessible, and human-centered, while being candid about what we have yet to learn. 

As we navigate the rapid pace of innovation in this AI era, our aim is not simply to bring AI into more places. It is to help people retain a stronger voice in what happens next, in their workplaces, their classrooms, and their communities. 

The post Expanding AI literacy with the Public Library Association and community-based programs appeared first on Microsoft On the Issues.

How are you, hacker? 🪐Want to know what's trending right now?: The Techbeat by HackerNoon has got you covered with fresh content from our trending stories of the day! Set email preference here. ## The Strange Programming Language That Helped Build WhatsApp By @zbruceli [ 15 Min read ] Erlang: a programming language built in a Swedish telecom lab in the 1980s, ended up running the biggest messaging app WhatsApp. Told by its co-creator. Read More.

AI-Assisted Genealogy: Using AI to Trace My Family Tree

By @nfrankel [ 7 Min read ] I continue working on my tree, and I have deepened my understanding of the subject. In this post, I want to share again. Read More.

Muse, Instinct, Wajo, and OpenAI's Dots: Four AI Assistants That Do the Work for You

By @hacker-Antho [ 5 Min read ] Four well-funded products from Meta, OpenAI, and fast-growing startups now compete on completed tasks: bills lowered, contracts negotiated, tables booked. Read More.

Did Elon Musk Buy Dot.com Just to Troll OpenAI’s New AI Agent Dots?

By @clapback [ 5 Min read ] OpenAI launched Dots, its new always-on AI agents. Months earlier, Elon Musk’s xAI acquired Dot.com—and now the domain redirects straight to rival Grok Bot. Read More.

AI Agents Are Killing the Git Client, Not Git: What Anthropic's Scion and Cursor's Origin Show

By @pairprogramming [ 30 Min read ] Anthropic replaced Git with Scion; Cursor launched Origin. Why AI agents make the Git client obsolete, which orgs should leave Git, and what GitHub must do. Read More.

The LLM Operating System: Transformers, Limitations, and the Need for Adaptation

By @metinyurdev [ 11 Min read ] Explore LLM architectures, general-purpose limitations, and why adapting models through Fine-Tuning and RAG is the real engineering challenge. Read More.

GPT-6 Astra: How to Write Better Prompts and Skills

By @proflead [ 9 Min read ] A vague skill description like "help with websites" misfires on unrelated requests. Trigger skills on the specific job, not the topic. Read More.

Why AI Agents Forget Everything (and How to Build Ones That Don't)

By @kapilbidikar [ 4 Min read ] Learn how agent memory captures events, retrieves relevant context, and forgets outdated information to make AI interactions more useful and personal. Read More.

Nemotron-3-diarization: Here's What You Need to Know

By @aimodels44 [ 7 Min read ] Nemotron-3-Diarization is an open-weight speaker diarization model from NVIDIA that identifies who spoke when in real-world audio. Read More.

Awesome Agent Skills: 49 Skills for Better AI-Assisted Coding

By @khasky [ 7 Min read ] Learn how to install and use Awesome Agent Skills with Claude Code, Codex, Gemini CLI, and Cursor to improve AI-assisted development workflows. Read More.

Everyone Rushed to Deploy AI Agents. Now the Security Debt Is Coming Due

By @thekonst [ 5 Min read ] AI agents can reach your data, tools, and systems. Learn how to list every agent, check its access, and close security gaps this quarter. Read More.

Is Software Really Dead? The Rise of AI-Powered Reverse Engineering

By @mendoncamaria [ 7 Min read ] An open-source tool called REA hit 100,000 GitHub stars in days. Here's what it does, the good and bad it's causing, and why the regulation fight is messy. Read More.

The Billing Ladder: Five Ways to Price an AI Agent

By @mayankc [ 6 Min read ] AI agent pricing is best understood as a ladder — seats, tokens, conversations, resolutions, outcomes — where each rung shifts the cost of a failed attempt. Read More.

Just Publish an App. How F*g Hard Can It Be?

By @radu14 [ 5 Min read ] I built my dream iOS app in two months while working full time, then got sick an hour after launch. An honest look at shipping solo. Read More.

What Happens When AI Agents Start Maintaining Legacy Code?

By @vikrantbhalodia [ 12 Min read ] AI agents can read and modify legacy code, but missing business context makes autonomous maintenance far riskier than it first appears. Read More.

This AI Model Has Native Text, Image, and Video Capabilities: Here's What You Should Know

By @aimodels44 [ 8 Min read ] Qwen3.6-35B-A3B-Uncensored-Genesis-Hermes-GGUF is a locally runnable, text-to-text GGUF release with native text, image, and video capabilities. Read More.

When Does Working Software Actually Become Legacy Software?

By @vikrantbhalodia [ 9 Min read ] Working software can still become legacy. Learn how security, maintenance, knowledge gaps, dependencies, and change costs reveal when software is aging. Read More.

AI vs. Super Intelligence: Is the Rename Actually More Accurate?

By @progrockrec [ 4 Min read ] Is "Super Intelligence" a more accurate name for AI? Not quite. Here's what AI and SI actually mean, why today's tech fits neither, and what to call it. Read More.

Bonsai-2-27B-Ternary-CRACK-GGUF: A 27B Model With Refusals Removed

By @aimodels44 [ 8 Min read ] Explore Bonsai-2-27B-Ternary-CRACK-GGUF, a 27B local AI model with refusal circuitry removed, vision support, reasoning modes, and GGUF inference. Read More.

I Built My Own "Muse Charm" on an ESP32 Stick: One Fast Brain, One Slow Brain

By @zbruceli [ 15 Min read ] Didn't wait for Meta's Muse Charm. Built my own AI pal on a $21 ESP32 stick. Read More. 🧑‍💻 What happened in your world this week? It's been said that writing can help consolidate technical knowledge, establish credibility, and contribute to emerging community standards. Feeling stuck? We got you covered ⬇️⬇️⬇️ ANSWER THESE GREATEST INTERVIEW QUESTIONS OF ALL TIME We hope you enjoy this worth of free reading material. Feel free to forward this email to a nerdy friend who'll love you for it. See you on Planet Internet! With love, The HackerNoon Team ✌️