---
title: "Discussion on \"One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate\" | Hashnode"
description: "Discussion on \"One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate\". A real bug bounty lesson about mass assignment, impact proof, and learning from weak reports."
url: "https://hashnode.com/posts/one-extra-json-key-how-a-harmless-profile-endpoint-became-an-ato-candidate/69ee7c173d6a492cdd4ecfcd"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate](https://shemkar.hashnode.dev/one-extra-json-key-how-a-harmless-profile-endpoint-became-an-ato-candidate?utm_source=hashnode&utm_medium=feed)

A real bug bounty lesson about mass assignment, impact proof, and learning from weak reports.

Apr 26 · 6 min read · shemkar.hashnode.dev  
Updated Sep 21  
Read the article

-   [#bug-bounty](https://hashnode.com/tag/bug-bounty)
-   [#web-security](https://hashnode.com/tag/web-security)
-   [#api-security](https://hashnode.com/tag/api-security)
-   [#mass-assignment](https://hashnode.com/tag/mass-assignment)
-   [#access-control](https://hashnode.com/tag/access-control)
-   [#account-takeover](https://hashnode.com/tag/account-takeover)
-   [#business-logic](https://hashnode.com/tag/business-logic)
-   [#bugbounty](https://hashnode.com/tag/bugbounty)
-   [#bugbountytips](https://hashnode.com/tag/bugbountytips)
-   [#bug-bounty-hunter](https://hashnode.com/tag/bug-bounty-hunter)
-   [#hacking](https://hashnode.com/tag/hacking)

## Written by

[shemkar](https://hashnode.com/@shemkar)

@shemkar

  
[View profile](https://hashnode.com/@shemkar)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.