Season 2 · Episode 37
$50K at 15: Zendesk Bug Bounty Drama, White Hats & Weak Links
A 15-year-old finds a bug that can slip into Fortune 500 Slack workspaces, walks away with US$50k in bounties – and the original vendor still says “out of scope.” In this episode of SEEK Bytes, the crew unpack the wild real-world story of Daniel (aka hackermondev), bug bounty culture, and what it teaches every IT pro about third-party risk, email spoofing and responsible disclosure.
SEEK Bytes · SEEK
April 8, 202529m 28s
Audio is streamed directly from the publisher (traffic.megaphone.fm) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.
Show Notes
What happens when a 15-year-old hacker quietly discovers a single bug that touches over half of the Fortune 500, chains it into a Slack takeover, and walks away with $50K in bug bounties – only for the original vendor to refuse to pay? In this episode of SEEK Bytes, we break down Daniel’s Zendesk exploit, the ethics of disclosure, and what “white hat” really means in practice.
We unpack how a “basic” support inbox ([email protected]), misconfigured SSO and email spoofing turned into a way to join internal tickets, steal Slack access and read sensitive conversations – all via a third-party tool many enterprises barely think about. We also dig into how bug bounty programs work, why Zendesk’s scope call sparked controversy, and how SEEK runs security exercises to stay ahead of attackers.
In this episode you’ll learn:
• How the exploit actually worked end-to-end – from Zendesk ticket IDs and CC’ing yourself onto “internal” threads, to chaining Apple/Google OAuth and Slack login for access to private workspaces.
• Why the bug bounty outcome was so controversial – how email-spoofing being “out of scope” left Daniel unpaid by Zendesk, and what this means for incentivising white-hat behaviour vs pushing hackers towards greyer choices.
• Practical security takeaways for engineers – the real risk of “weakest link” third-party tools, why internal channels are goldmines for social engineers, and how separation of concerns and well-designed bounties can protect both your systems and your customers.
Whether you’re in software engineering, security, cloud, support, architecture or IT leadership, this episode is a gripping case study in modern attack chains, bug bounty programs and why “it’s just email” or “it’s just a ticketing tool” is never the whole story.
👍 Follow the SEEK Bytes podcast so you never miss a new episode