Justin Gardner (Rhynorater), Joseph Thacker (Rez0), & Brandyn Murtagh (gr3pme)
173 episodes listed below
PRESS PLAY
A "by Hackers for Hackers" podcast focused on technical content ranging from bug bounty tips, to write-up explanations, to the latest hacking techniques.
Based on 6 episodes we listened to · September 2026
Detailed conversations make bug discovery, impact assessment, and reporting methodology legible from a working researcher's point of view.
Critical Thinking - Bug Bounty Podcast treats security research as work that can be examined, questioned, and improved. The conversations move between bug reports, reward decisions, testing methodology, and the technical mechanics behind an exploit.
The world's dumbest fuzzer sounds pretty smart when you're stuck on a bug.
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A grounded bug bounty conversation about preparation, speed, and knowing when to step away.
This episode frames bug bounty success as something less glamorous, and more useful, than a sudden flash of technical genius. It starts with a sharp joke about stolen reports and borrowed credit, then settles into the practical rhythm behind faster, cleaner submissions: prepare…
A grounded look at when an AI tool's freedom helps a hacker, and when structure keeps the work honest.
The episode treats AI-assisted hacking less as a novelty than as a workflow design problem: how much freedom a tool should have while mapping a client-side attack surface.
A bug bounty trust debate turns AI-data anxiety into a practical question of disclosure and escalation.
The episode centers on a live trust issue in bug bounty work: how researchers should respond when they worry submitted techniques or reports could be used by AI systems.
A loose hacker conversation finds real security stakes in the hidden functions behind managed cloud services.
Cloud security research gives this Critical Thinking episode a clear center of gravity. After a looser opening around an Adobe bounty promotion and updates on Cloudbot, OpenClaw, and Cloud Code, the hosts settle into the stronger thread: privileged accounts that managed cloud…
A practical bug bounty episode about cloud targets, report quality, and how rewards are decided.
The episode stays focused on the bug bounty details that matter most in practice: making reports easier to reproduce, understanding how cloud configuration shapes what researchers can test, and seeing how an unusual setup can change the reward path.
A charity hack-along recap becomes a clear browser-security lesson on null event sources and loose comparisons.
This single-episode review turns a charity hack-along recap into a focused lesson on how live hacking can build a working memory for bugs, browser behavior, and researcher techniques.
A practical bug bounty conversation with clear process detail and a career story rooted in security work.
A practical episode that starts with ThreatLocker elevation control and then moves into Sasi Levi's path through software engineering, R and D, and late-night bug bounty work.
A browser-security discussion that moves from ThreatLocker elevation control into null-origin iframes, `postMessage`, and MessagePort handling.
This episode starts with a practical ThreatLocker detour, then moves into client-side edge cases around null-origin iframes, `postMessage`, and MessagePort handling.
Deeply researched narrative dives into hacking history and cyber-law cases, hosted by Ran Levi.
Reported narratives on hackers, spyware, and data crimes from Dina Temple-Raston.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
IAPP's Jedidiah Bracy interviews the regulators and lawyers writing privacy and AI law.
A daily cybersecurity briefing hosted by Dave Bittner, pairing breaking incidents with a guest interview.
Critical Thinking opens with spooky energy and heads straight into hacker war stories.
Critical Thinking - Bug Bounty Podcast Episode 156 centers on an AMA from bugbounty.forum, with questions about AI agents, live hacking events, bug value, and getting started.
Critical Thinking - Bug Bounty Podcast episode 158 centers on a 10-hour charity hack-along in the CTPB Discord, with five people rotating through two-hour blocks and live narration proving much harder than expected.
Justin and Richard spend much of this episode on AI-assisted bug hunting, including a Kaido workflow for decoding protobuf-encoded parameters and a discussion of Claude's growing ability to host and deploy projects.
Critical Thinking - Bug Bounty Podcast Episode 163 covers PortSwigger Top 10 2025 research, starting with parser differentials that let JavaScript, Erlang, and Java interpret duplicate keys, double Authorization headers, and YAML tags differently.
Critical Thinking - Bug Bounty Podcast Episode 161 opens with a Gemini exploit chain that turns a user's 2FA code into DTMF tones and calls it out over a phone line.
Critical Thinking - Bug Bounty Podcast Episode 140 centers on Jorian's article, "Exploiting Web Workers XSS with Blobs," and on a new research lab submission model at ctbb.show.
Tommy DeVoss explains how a Yahoo SSRF in Las Vegas became an $180,000 payout, with each of 18 reports paying $10,000 and the money funding a Nissan GTR.
Critical Thinking - Bug Bounty Podcast episode 157 centers on Enrique Hyperdude and CVE-2025-2742, a heap overflow in MediaTek kernel drivers inside a Netgear router.
Critical Thinking - Bug Bounty Podcast Episode 155 centers on 2025 hacker stats, 2026 goals, and the realities of full-time bug bounty work.
Critical Thinking - Bug Bounty Podcast Episode 147 centers on Hugo and Justin trading workflow shortcuts for faster bug bounty work, from Kaido command-palette encodings to Chrome DevTools' Edit as HTML.
Critical Thinking opens with its usual community housekeeping.
The episode opens with a pitch for the Critical Thinkers tier in the CTV Discord before Matt Brown joins the conversation.
Brandon lays out a Notion-based note-taking system for long-term bug bounty work, starting with target tech stack, third-party components, and a “brainstorming / risks” section.
The episode opens with a conference promo, then settles into a week-in-bug-bounty conversation about cloud research.
The episode opens with its usual housekeeping, including a sponsor read about ThreatLocker DAC and a quick bit of banter with Nick, also known as Turbo.
Critical Thinking - Bug Bounty Podcast Episode 154 focuses on starting a pentesting company on top of bug bounty, with the hosts comparing bug bounty income volatility to the steadier cash flow of contract pen tests.
Two hackers discuss their experiences at recent live hacking events and share insights on bug bounty techniques.
Episode 167 features a conversation between Jason and Valeriy Shevchenko, a highly-ranked HackerOne bug bounty hunter (98th percentile impact).
Critical Thinking - Bug Bounty Podcast episode 166 centers on Rez0's methods for using Claude skills in bug bounty work, including custom VPS setup, hidden techniques, and tools like Kaido.
The hosts discuss recent bug bounty research, including a Cloudflare zero-day WAF bypass, SSRF/XSS via email unsubscribe headers, a Heroku Postgres superuser vulnerability, parser discrepancies for XSS, and AI magic string attacks.
Brandon Grett discusses AI red teaming terminology with HackerOne experts Rezo and Luke Stevens, clarifying industry confusion.
Technical security podcast discussing 10-hour charity hack-along event involving five security researchers.
This Critical Thinking - Bug Bounty Podcast episode centers on Sasi Levi's Vertex AI and Gemini Enterprise research, where a single prompt could pull Gmail, Google Docs, spreadsheets, and calendar data from workspace sources.
This episode dives into advanced client-side hacking topics, covering PostMessage vulnerabilities, iframe sandboxing tricks, and URL parsing bugs.
I love it when you pop a vuln quick - that's the opposite of imposter syndrome
Episode 148 of Critical Thinking - Bug Bounty Podcast is a solo Model Context Protocol deep dive after both co-hosts were sick or traveling.
Critical Thinking - Bug Bounty Podcast Episode 144 centers on Bus Factor and Kieran describing how they collaborated at a Google live hacking event in Mexico and finished second overall.
Co-hosts Justin and Brandon discuss live hacking event strategy, competitive bug bounty hunting, and advanced exploitation techniques.
This episode covers bug bounty tips, AI red teaming CTF, and a Ruby LFI challenge.
A podcast episode discussing recent bug bounty news, including a high-paying jailbreak bounty and a Mozilla VPN RCE vulnerability, with a focus on AI-assisted source code review.
A technical podcast discussing bug bounty tips, hacking techniques, and a sponsor segment about an EDR tool.
A technical podcast for hackers discussing bug bounty tips, hacking techniques, and a recommendation for Threat Locker's EDR tool.
A podcast episode discussing bug bounty tips, zero trust innovations, and a live hacking event at NullCon Berlin.
A hacker discusses three bugs, starting with a client-side takeover via post message on a public program.
The hosts discuss using AI micro agents for hacking, including obfuscation bots and specific tools like Acquisition Finder GPT and Subdomain Doctor.
A technical podcast episode discussing bug bounty tips, elevation control with ThreatLocker, and an interview with a prolific AI hacker about prompt injection.
This episode discusses converting partial cookie injections into full ones and other cookie quirks, along with caching write-ups from a CTF.