We only write up a vulnerability after the patch ships — the reproduction steps, the attempts that failed, and why we looked there in the first place.
The 02 AI-Driven Research section from the home page, written out at working detail: where the model sits in recon, code audit and variant analysis, where false positives get killed, and which steps stay manual.
The house format for research notes: every frontmatter field and what belongs in it, how to use code blocks, images and tables, and the redaction checklist that runs before anything is published.
How TEAM N1TRO reports the vulnerabilities it finds and when it publishes them: the disclosure window, the exceptions, and what vendors and reporters can each expect from us.
What TEAM N1TRO publishes, what it does not, and where the line sits. A short note on the scope of everything that will follow on this page.
Findings whose fix has shipped, with the write-up still in preparation. Vendor, class, identifiers and bounty are listed; only the details, reproduction steps included, are members-only.
| Vendor | Class | Refs | Bounty | Status |
|---|---|---|---|---|
| Authentication bypass | CVE-2026-31337 | $10,000 | patchedSep 2026 | |
| IDOR | — | $5,000 | patchedSep 2026 |