Valentino's issue tracker
Elementary school
Let’s start from elementary school. When looking at a language, we are seeing syntax. There are rules and we must follow some syntax to pass exams.
If the system’s rules state the alphabet follows this exact order, then that’s the rule students must follow.
When I first learned there was an arbitrary order we were supposed to follow, I wondered, why does order matter? Why do I need to arbitrarily follow this mandate which doesn’t have a clear reasoning? What if order didn’t matter?
I would only hear “because it is a rule”. A rule for what? Rules have reasons behind them, they shouldn’t be arbitrary, I guess.
So, they would task us with writing simple things like names. For instance, I would write the name “ANDREA” like this:
It doesn’t follow syntax! The student doesn’t know the basic syntax of the evaluated language, thus, FAILED! I was surprised to find out they were actually quite serious about the syntax rules. With fresh eyes today, we could say my input caused unintended behavior based on how the teacher reacted.
We were supposed to learn things in a formatted way. Everyone following a protocol. A standard. A happy path.
There was an intended way of formatting text, and other ways were deemed as unintended, or “wrong”. After learning how important the syntax and formatting rules were, I learned the intended way and passed the exams (can be seen as following the “happy path”).
A fun game
Many years later, in May 2023, on a typical day in a pentest firm, I was doing the usual engagements, just sitting in the office chatting with a coworker. We were talking, and he told me, hey have you looked at this tweet by Google VRP: https://x.com/GoogleVRP/status/1662061036814336001. I’ve never ever looked at Google before, or done much bug hunting outside of work. I just felt hypnotized by that form, I just felt deeply hooked, like a magnet was pulling me into a different world. I didn’t know what was happening, but I simply decided to give it a try.
The form was asking us to play a game with Gandalf AI (lakera.ai), and reach Level 8. After reaching that level, we would get a flag and submit it along with other information. I started seeing how each level’s filters could be bypassed triggering unintended behavior (tricking the AI into leaking a secret), and it was very fun. However, I reached Level 7 during my work break. It was getting late, and I needed to get back to work, so I just thought, okay I reached this, I’m going to submit what I have along with the other questions asked in the form answered.
I thought, yeah, they are never going to call me. Let’s continue working and just forget about it. It was a fun game at least.
At the end of June, I got a very surprising email telling me I was selected for a Research Grant! I couldn’t believe how that even was possible, and I just felt super happy.
The first research grant
I already kinda knew the flow because of my pentest work. We needed to attend a scope call, and they would give us the details. So, I just tried my best at the moment and tried to have fun doing what I’m passionate about - understanding and hacking systems. At the end of this research grant (a few weeks), I just found 2 minor bugs in the presented scope.
At that moment, I thought, well that’s it. I didn’t find a high/critical bug, so they will probably not invite me anymore to research grants. It was a fun experience, and it felt good to be part of this research. It was nice they considered me.
The first bugSWAT
After a bit, in August 2024, I got a message asking if I was going to attend DEFCON31. I wasn’t considering travelling because it was very expensive to cover flights & hotel. I’ve never been to the USA before. I told them I unfortunately couldn’t attend, however, they surprisingly offered to pay for flights & hotel, so I just said YES.
So, I just needed to find a way to buy a flight ticket that greatly exceeded my modest debit card limit (300-500 USD). How am I going to travel to bugSWAT if my bank doesn’t let me? Well, I luckily was able to use my father’s card, and later reimbursed him the costs via a bank transfer in smaller payments.
Okay, flight solved. What about the hotel? Turns out, I was 19 years old, and couldn’t go to most casino hotels in the area because I was under 21 years old… Great! So, I needed to find a workaround for that. Seems like I’m hacking before attending bugSWAT. So, after some research, I realized there were some family / vacation hotels that allowed guests older than 18 years old (instead of 21 years old).
Cool, I just need to choose one of those family hotels closest to the bugSWAT address. Not so easy! Many of those hotels only accepted credit cards, and you weren’t allowed to pay with cash. My modest debit card was 100% going to fail when trying to pay for the hotel bill, the staff was going to detect it wasn’t actually a credit card, or my card would get blocked for security reasons. Either way, I was most probably going to stay in the streets of Las Vegas if I didn’t solve this in a secure way.
So, I had to bring cash. Yep. To put you into context, in 2023, in my country, it was not super easy to get cash by just going to a bank ATM machine because of currency restrictions and some complicated stuff. The problem was getting USD in cash quickly because the event was getting really close, so I asked family members again for some cash, and later reimbursed them.
However, how am I going to pay for Uber? Because my debit card was very bad, and it would sometimes randomly block Uber ride payments abroad. So, I had to take cash for taking an emergency taxi just in case. It turns out, my card was blocked for 48 hours for trying to use an ATM in the hotel, and I just had to take a cab every single day of the event, so redundancy worked well. Sometimes when time wasn’t a problem - when returning after the event, I would make a phone call to my father and he would try to approve some Uber payments via his bank app so I could take a ride, but sometimes that would also get blocked for “security reasons”.
Regardless, everything was mostly solved. I travelled to Las Vegas alone, and arrived at the hotel. I just felt amazed by this opportunity, and I knew the next day I was going to wake up and meet the Googlers and Bug Hunters. Meeting some Bug Hunters like rez0 and lupin for the first time was like meeting someone you saw in a movie before (like a movie actor) - they are amazing, but they were suddenly sitting across from you, working alongside you. When thinking about the Googlers, I was less familiar with them compared to the Bug Hunters; at first, I didn’t imagine they were just humans, I just didn’t know what a Googler looked like, you know, I was very naive. I just didn’t know what to expect, but they were super cool people and actually verified they were real! and I felt welcomed, kinda part of the club.
We had a really nice time seeing how things can work in intended as well as many unintended ways.
After a ton of fun, I went home. Kinda sad I couldn’t find super cool bugs yet, but at the same time amazed and wanting to attend another bugSWAT. I wasn’t able to put into words how this felt. I cannot really go into detail for each event, because it would be endless to write! Anyway, in this event, I was very happy to get the “best newcomer” prize and my very first Google swag.
University, work, and bugSWAT 2024
After bugSWAT, I kept working in pentesting and just kept thinking about bug hunting for Google. It was just a thought that kept running and it was still there around always. In 2024, I decided to enroll in a Computer Science degree, and after one year, I really learned a ton from the mathematics courses we were taking, but still we weren’t doing a lot of programming / CS topics that would be covered in the following years.
For August 2024, I surprisingly got invited to another bugSWAT in Vegas! This time, I was more prepared for everything, so it was smoother than the first time. However, I was working, attending university and doing bug hunting, so it was very hard to handle. At the time, I had finished my first university term being able to pass Calculus I and other subjects.
In that moment, I had to make a very hard decision. I couldn’t do three things at once, so I had to sacrifice. On August 1st, I quit my job and decided to split focus between mostly university and whatever time that was left for bug hunting Google. Even though at that moment I had the free time for bugSWAT, because the dates just matched some weeks of university recess, I wasn’t fully transformed into a bug hunter, the mindset and target-specific skills weren’t there yet and most of my time during the year was going into university.
This bugSWAT was way bigger. I just went there, and met many amazing people, I just couldn’t stop asking questions, and was very eager to know them. I felt lucky to be there, and wanted to prove I deserved to be there. Many times I asked myself, why do they even keep inviting me? I just couldn’t understand it, but I felt I had to work really hard to make it worth it. So, even though I did a ton of work during the event trying to learn as much as possible from everyone, and to try and find something in scope, I couldn’t. At least something reportable as a real finding that would get accepted under the VRP rules back then.
I just felt completely defeated, it was very hard. When coming back to the hotel, I just started crying all the way back. That was it, I missed my chance to prove myself and my bug hunting career was over. I thought to myself, what am I even doing with my life? I sacrificed my job, and couldn’t even find bugs for this important event that was my dream. What am I going to do next? On top of that, rent and bills weren’t going to pay themselves and savings were slowly burning. I was saving money by hand-washing clothes with soap and some old centrifuge machine my grandma lent me - basically avoiding buying new electronic appliances overall, horrible coffee, old clothes, and just optimizing everything to avoid burning money unnecessarily just in case I needed it for something important.
After some time, I was able to calm down, and continue my university studies and luckily had some freelance pentest opportunities that were helpful especially at the end of the year when I had another university recess. So, I could live a few more months without totally burning savings.
Tokyo bugSWAT 2025
On December 21, very close to Christmas Eve, I was just talking with my mother about researching Google and how I felt stuck with this Gemini research. She just told me, “have fun, actually, play with the product”. I listened, and I just started playing around, and… I found my first AI bug. I immediately went and reported it. It felt good, some things started to click in my mind. I was getting more and more familiar with the product.
After some time, I didn’t really expect other invitations. I already felt the opportunities were gone, at least for a while. But, one day, I check my email and see something I couldn’t realistically believe; another bugSWAT invitation for Tokyo. This one was specifically focused on Google AI products.
The flights & hotel were definitely going to hit my savings at least until reimbursement. Nevertheless, it truly felt like my last shot. There was no way I’d get another chance after this. So, I made a very hard decision. What’s more important, my bug hunting dream or university? I dropped out of university that day.
At that moment, my mind and soul were 100% invested into this. I truly had to work extremely hard to prove myself and deliver. The product’s threat model wasn’t just suggestions or ideas, my heart and soul needed to be attached to the product, I needed to feel the patterns when they emerged and I needed to know what they meant to utilize them in exploit chains, anything less was just not going to cut it. Whenever my mind would say “Try this”, I wouldn’t say “No, that doesn’t make sense”, I would go, and just try it, that’s the end of the argument, and keep trying until the job was truly done. There was no other way, make it now or it was truly over, no more bugSWAT, the death of a dream, completely burned into ashes. I drastically changed my testing approach, and the sheer will to find bugs no matter what, and God knows where all that waterfall of energy and creative ideas came from, but it luckily worked. One bug after another, one exploit chain into another, I was flying. Almost every single day.
After the event timer for reports reached its end, I felt a huge relief, this time, I delivered. In the meantime, I go read my email on my phone, and saw some bounties come in, it was truly unbelievable. I remember going to the Google office bathroom just because it was too much to handle emotionally. I had a ton of weight on my shoulders, and I truly felt I finally got more road to ride to continue this dream I wanted to pursue. Those bounties marked a life-changing point, they bought me many months of freedom that could be re-invested into pursuing Google bug hunting full-time without worrying too much about economic needs, or diversifying my focus into other things.
Then, we went to the awards ceremony, and they started calling each winner. When they said “2nd place”, and my name, I was very surprised and happy. It was my first physical bugSWAT prize. I felt my bug hunting career was not over. It was kind of, like a miracle.
I was so happy, I went back home, and when arriving at the airport, they lost all my bags, I was still smiling and very happy. I just thought, I made it. I truly made it. How? I don’t know. But how? Does it matter? I just did it, and I can finally feel I’m contributing value to something I deeply care about. Everyone was complaining about the bags, I just felt nothing mattered except finding the next bug, the next exploit chain, chasing the next ideas. The bags were just misrouted, and they appeared after a bit of waiting in the airport line, so that was nice too.
Vegas bugSWAT 2025 and ESCAL8
After bugSWAT Tokyo, many things happened, and after a while, I decided to try out my life in Italy. I travelled there, and spent a few months. They truly were the worst days of my life due to some things I won’t go into detail, and that was indirectly affecting my bug hunting quality. I was still pushing to deliver at least something of value for the events to keep up, but I felt I could do better, it wasn’t enough. The events were phenomenal, however I wasn’t delivering like during Tokyo.
After the events finished, I came back home to my home country. I just needed to fully recover and get over whatever was pushing me down. I was just feeling demotivated and turning into ashes.
Seoul 2026
Getting close to March - April 2026, I was almost fully recharged and ready to engage. It was time to deliver. However, it wasn’t the same feeling of desperation from Tokyo. This time, I was doing it to have fun, to enjoy. The full-time bug hunting runway was paved, and I had the combination of freedom, energy and creativity to push hard for bugs in the products. I really wanted to do really good work, and I needed it to happen again.
I always dreamt about winning the MVH prize, but I wasn’t expecting to get it soon. During my flight from Paris to Tokyo, I was watching the F1 movie, and just felt I wanted to feel like flying when bug hunting in the event, similar to the movie’s character when racing at incredible speeds. It was a very similar feeling, and many things presented in the movie felt so closely related and useful for bug hunting somehow.
So, I just went into the event, and finished some bugs. It was really fun, and I enjoyed it a lot, especially those special moments that will be forever in my memories from all these events. After that, in the awards ceremony, I was very surprised about the MVH, and it felt great to be recognized in such a way for my work.
Interviewing for Google
During my years bug hunting Google products, I was always curious about what it’s like working on the other side - working at Google. Just maybe doing things at another scale, more complex bugs, deeper understanding. I just decided to give it a try, and applied for a Security Engineer role.
I got the interview via a referral way back in 2025, and it was something I wasn’t well prepared for. Bug hunting work is significantly different from Security Engineering. Being good at finding bugs is crucial and helps, but there are additional factors that have relevance such as coding amongst other non-technical areas such as communication and productively working with different teams in a large organization such as Google.
In my opinion, perhaps sometimes the bug hunting mindset can make more linear software engineering look more counter-intuitive than it should. Sometimes, delving too much into unintended behavior might make it hard to follow more linear developing processes. It’s a different way of looking at things, it’s both illuminating and refreshing, but a different kind, and might require some reprogramming to fully adapt into different roles that perhaps require a diverse set of skills for productivity, but I’m not entirely sure yet.
Honestly, not sure when and for what I might apply next. Not even sure what I’m a great fit for, except the current work I’m doing as a bug hunter. I just want to keep being useful and contribute value without getting off track. I also want to keep attending bugSWAT and keep communicating with both Googlers and Bug Hunters who are deeply passionate about this kind of work. They are truly the best events I’ve experienced and I really would miss them a lot.
I love full-time bug hunting for Google, it’s very challenging and it’s currently the most amazing thing I’ve worked on so far, and it keeps amazing and educating me every single time. So, it’s also very hard to prepare for interviews and also decide to pursue a role sometimes, because stopping my bug hunting dream for something I’m not entirely sure is a great fit for my skills is honestly not ideal unless there are some baseline guarantees I can attest to. So, it’s time for hard decisions that need clear consideration, and that just takes time and effort. I think it’s about time where strategies are the main driving factor of my decisions, and hope is less and less prevalent, although hope is still important nevertheless.
Thank you all, I really do appareciate it.