- Discovered a debugging endpoint on Google Cloud's internal API that leaked protobuf definitions for any service, including YouTube.
- Leaked internal workflow execution queue containing client_id 'default', enabling further access.
- Collaborated with another researcher to bypass publishing restrictions and achieve Remote Code Execution via GenericStubbyTypedTaskV2.
- First RCE was awarded $60,000 by Google's VRP.
- Three months later, found an IDOR vulnerability in the public Application Integration product that leaked test case IDs across projects.
- Used binary search on test case filter parameter to extract victim integration version UUIDs, enabling cross-tenant access.
- Attempted to chain IDOR with internal task types like PythonTask and GenericStubbyTypedTaskV2 for another RCE, confirmed exploitable.
- Second RCE awarded $75,000, plus $13,337 for a remaining vulnerable endpoint.