REM warisjeet singh (sin99xx) — self-taught security researcher
hi, i'm warisjeet singh — just call me waris. everywhere online i'm sin99xx. this is the short story of how i got here. did exactly one semester of college and dipped — just because .. started security research and bug bounty in january 2025. 24 now, self-taught, no plan beyond the next bug. started sending reports, they started landing — right now i'm #2 on the KOHO leaderboard and top 3 on a major private program, with accepted findings across 1win, doordash, monero, whoop, eightfold, and a pile of private programs. one of them was against the bugcrowd platform itself — report the platform you report on. poetic. plus 3 findings in tor browser, all in noscript.
receipts
cves
| qemu vga | CVE-2026-17516 heap oob write |
| qemu vga text | CVE-2026-77913 oob write |
| qemu | CVE-2026-48004 heap uaf |
| qemu usb-ccid | CVE-2026-18204 oob read |
| exim | CVE-2026-48840 pre-auth leak |
| gemini ios | CVE-2025-5009 info disclosure |
| joomla com_modules | CVE-2026-48956 access control |
patches merged
| go google | CL 789862 crypto/tls |
| xnnpack google · litert | #10464 heap oob write |
| xnnpack google | #10463 oob read |
| xnnpack google | #10373 heap oob write |
links
open to the right problem: research, disclosure, or something worth building.