~~Claude Code Meetup · April 16, 2026 · Nuremberg~~

KI Navigator November 18, 2026 · Nuremberg

How I Accidentally Became #2 VDP* Researcher for Germany on HackerOne

HackerOne Germany VDP leaderboard showing fbettag

A candid story about building iteratively with Claude Code and ending up on the HackerOne VDP leaderboard for Germany.

bett.ag x.com/fbettag hackerone.com/fbettag uberblo.gs

* VDP = Vulnerability Disclosure Program

V2.0

Outline

Here’s where this goes in the next 45 minutes

~1 min Who am I

~8 min · Deep tech What I built and how it evolved

~8 min · Practical The build method & universal loop pattern

~5 min · Blueprint How to adapt this for your own projects

~18 min · V2.0 And then… what happened since.

Q&A

The first part is technical on purpose: vulnerabilities, architecture and implementation details up front to get you started. The second part focuses on reusable patterns you can take home. The final third covers the new additions: how I reused what I learned and what I built with it.

Who I am

Franz Bettag Polyglot engineer since 2001

25 years of consulting for enterprise to Fortune 500. On-prem, cloud, AI, security, and development — paid projects in 30+ languages before AI came around.

On-Prem & Cloud, AI & Security Engineering for Enterprise to Fortune 500

Most notable for the German market kleinanzeigen.de

Sole IT Engineer next to the CEO. Re-developed the platform from 2014–2019 serving 30M+ monthly users, then exited to eBay.

Wall Street HFT block-trade optimization

Tasked to fix a critical performance bottleneck. Found a $2M+ accounting error while rewriting the system. Cut monthly job runtime from 2+ hours to 5 minutes.

Fashion @ Scale Nordstrom / HauteLook

Rebuilt flash-sale push notification infra for the largest fashion retailer in the US. 10M+ concurrent pushes, delivery cut from 2 days to under 10 minutes.

Family lore

If you recognize my last name, it's probably because my grandfather invented the BobbyCar and was the founder of BIG Spielwaren.

The prompt that never works

Build me a billion dollar business.
Make no mistakes!

Find me a $100k bug bounty!
No false positives!

Validated outcomes

The ranking followed real shipped findings

CVE Keycloak CVE-2026-1190

Critical fix 2x ClickHouse RBAC bypass

Subdomain takeover 3x Amazon VDP

Subdomain takeover OANDA VDP

Subdomain takeover → SIP / VoIP infrastructure takeover Opera

Valid finding Ruby on Rails

Architecture

One canonical backend. Distributed execution.

Control plane

Central server

State, orchestration, findings, submissions, operator UI.

Session layer · 56 agents

Agents = identity + method

Full session prompts: exploit-web-attacking, recon-subdomain-discovery, audit-finding-verification, …

Tool layer · 200+ skills

Skills = composable building blocks

Reusable techniques: subdomain-takeover-detection, nuclei-scanning, playwright, sqlmap, …

Execution

4 pwn hosts + shared CLI

A shared bounty-cli standardizes every host run.

Infra

NixOS + flakes

Deterministic infra, reproducible deploys, auditable config.

Design rule

Validation-first state machine

Every risky phase emits an artifact that must pass a gate.

Active on all major platforms

Built with Claude Code

Evolution

Every change was a scar, not a plan

Start with the smallest useful slice

Central server first. One source of truth.

MCP was useful, then expensive

Good for early iteration. Bad for token and context efficiency. Replaced with a shared Go CLI.

Push execution to workers

Parallel campaigns across architectures: Linux for web & Android, macOS for BinDiff fuzzing, iOS firmware diffing & Simulator app testing.

Separate agents from skills

Agents own the session identity. Skills are composable tools agents invoke. Clear contract between the two.

Every step was driven by a real constraint, not a design preference.

Do NOT try to one-shot complex systems. Go feature by feature.

Why not MCP?

MCP burns tokens. A CLI + skills doesn't.

MCP sends full tool schemas on every request — context cost scales with tool count.

Every tool invocation round-trips through the model. Five tools = five inference calls.

A CLI runs locally with zero token overhead. Skills are injected only when needed.

Result: same coverage, 10–20x fewer tokens per campaign run.

MCP approach

Model → tool schema → inference → tool call → result → inference → …

High token cost per step

CLI + skills approach

Prompt → agent runs locally → skills execute in-process → results to server

Tokens only for reasoning

Case study

Opera SIP takeover: why recon automation matters

_sip._tcp.opera.com.   86400 IN SRV 0 0 5060 e1.viju.vc.
_sips._tcp.opera.com.  86400 IN SRV 0 0 5061 e1.viju.vc.

The rig flagged dangling SRV records pointing at e1.viju.vc — a domain that no longer existed.

RFC 3263 compliant SIP clients would resolve Opera's SRV records into whoever controls viju.vc.

I registered viju.vc manually, pointed e1.viju.vc at my infrastructure, and confirmed the takeover.

Responsible disclosure to Opera via Bugcrowd. Domain held as proof, not weaponized.

Legacy DNS edge case

High signal, low noise

Best found by broad automation

Context priming

Every session is a new hire

An A-grade engineer who knows every tool — but nothing about your project, your architecture, or your constraints.

Without priming, it will produce generic code that technically works but doesn't fit your system.

The question for every session: “How do I explain what I need in the fewest words while still conveying the architecture and the problem?”

CLAUDE.md

Project rules, coding conventions, architecture overview. Loaded automatically every session.

Memory

Learnings from past sessions. Mistakes, patterns, decisions the agent shouldn't repeat or forget.

Your prompt

The specific task. Short, precise, assumes the agent already knows the context from the layers above.

Reusable loop

The whole trick: separate, gate, compose

Discovery

Map the surface and emit concrete candidate artifacts.

Execution

Probe inside a bounded role with explicit success criteria.

Validation

Reject weak artifacts before they contaminate later phases.

Composition

Chain only validated pieces into a higher-value outcome.

Feedback

Update prompts, routing rules, and profiles from misses.

The point is not "more agents". It is fewer ambiguous handoffs.

Same loop, shipping infra

Ship a CI/CD pipeline from zero to deployed

Discovery

“Investigate this repo. How is it built? What framework, what output? Create an initial git commit if there isn't one.”

Execution GitLab

“Build a GitLab CI/CD pipeline with Auto DevOps for Kubernetes deployment. Look at similar projects for reference.”

Execution GitHub

“Set up GitHub Actions to build a Docker image and deploy to Kubernetes. Look at similar projects for reference.”

Validation

“Commit, push, and check the pipeline status. If it fails, read the logs and fix it. Repeat until the pipeline is green.”

Composition

Build passes → image pushed → deploy triggered → pods running. Each stage gates the next.

Feedback

curl https://your-domain.com returns 200. If not, iterate. You are done when the site is live.

Blueprint

How to copy this tomorrow

Discovery Pick one problem. Map the surface. Define the success artifact.

Execution Probe inside a bounded role with explicit success criteria.

Validation Reject weak artifacts before they contaminate later phases.

Composition Chain only validated outputs into a higher-value outcome.

Feedback Feed misses back into prompts, profiles, and routing.

Start here. Repeat until stable. Then scale.

Same loop, shipping code

Ship a feature with `/code` 9 agents. One command.

Discovery

/code <feature> — the Architect agent asks up to 5 clarifying questions, then designs schemas, contexts, LiveViews, and routes.

Execution

Feature Developer implements the following 2,280 lines of project patterns — domain-driven design, typed schemas, LiveView sessions, Petal UI components.

Validation

Feature Tester runs mix quality. Feature Translator wraps all user-facing strings in gettext and translates to every supported locale.

Composition

Feature Committer analyzes the diff, determines conventional commit type and scope. No commit without green tests. Each agent gates the next.

Feedback

Higher-order commands (/gdpr-audit, /audit-legal, /public-launch) re-run audits after /code. Findings become new /code runs.

One more example

GitLab v15 → v18 on Kubernetes. Overnight. Unattended.

Discovery

“Explore our current setup in read-only mode on this Kubernetes cluster, then do a full backup.”

Execution

“Research the best upgrade path. Do not skip intermediary steps. Verify dependencies and requirements for the new versions.”

Validation

“Start the upgrade procedure. You are done when all services that are currently running and up are successfully upgraded and responding.”

Composition

Each intermediary version (v15 → v16 → v17 → v18) is a validated artifact. PostgreSQL migrated in lockstep. Only proceed when the previous hop is healthy.

Feedback

Failures at any hop feed back into the next attempt. The agent retries with context, not from scratch.

Takeaway

Don’t start with one giant prompt. Start with a loop.

Security is the example. The architecture is the reusable asset.

https://bett.ag https://2342.gmbh Full write-up

Normally, this talk would end here.

Boris Cherny, creator of Claude Code at Anthropic

But 47 days after my talk on April 16, 2026,
this Boris Cherny interview came out.

“My job is to write loops.”

Boris Cherny · Anthropic
Acquired Unplugged · published June 2, 2026 · 11:50

So I kept writing loops. They went somewhere I didn’t expect.

This is where the original talk ended. Reveal Boris's photo and timing, then his quote, then the final transition. Original talk: 16 April 2026. WorkOS published the Acquired Unplugged interview on 2 June 2026, 47 days later. The 47 days refer to publication, not an independently verified recording date. Exact quote verified in the original video's transcript at approximately 11:50: My job is to write loops. https://www.youtube.com/watch?v=RkQQ7WEor7w&t=710 Interviewed by Acquired hosts Ben Gilbert and David Rosenthal at a WorkOS event. The earlier Training Data episode was published 5 May 2026 and contains a different remark about loops being the future. Portrait reused from the neighboring start-with-a-loop deck; it shows Boris at AI Ascent, not the Acquired interview. The new chapter opens with Apple and Chrome, then covers Hibiscus, FreeBSD, NetBSD and OpenBSD. These are local research and disclosure stories beyond the bounty and VDP rankings.

The surfacea web hunter is supposed to find.

Start where you’d expect me to: the browser engines that render the whole internet.

Browsers → Software I trusted → The kernel

Apple: one WebKit finding.
Across the platform family.

CVE-2026-112680. Apple publicly credits this research.

The input was web content.
Crafted content could trigger an out-of-bounds read in WebKit.
The impact was memory disclosure.
Processing that content could expose data from process memory.
The fix reached multiple products.
Apple added bounds checks and shipped the repair across its platform family.

Safari · macOS
iOS · iPadOS
visionOS

One CVE, listed in five Apple security advisories.

Fixed in 27.2 releases and iOS / iPadOS 26.7.2. Apple advisory · el8.nl

Verified against el8.nl and Apple's published advisories on 9 November 2026. CVE-2026-112680, WebKit Bugzilla 323148, credits Franz Bettag, Kwak Kiyong and Song Nuri. This is one confirmed CVE shared across products, not five distinct CVEs. Safari 27.2: https://support.apple.com/en-us/149527 (macOS Sequoia and Tahoe). iOS and iPadOS 27.2: https://support.apple.com/en-us/149230. iOS and iPadOS 26.7.2: https://support.apple.com/en-us/149227. macOS Golden Gate 27.2: https://support.apple.com/en-us/149521. visionOS 27.2: https://support.apple.com/en-us/149526. All five pages contain the CVE and Franz's credit. The published impact is process-memory disclosure, not code execution. Do not extend the platform claim to watchOS or tvOS without another advisory.

Chrome: a background response.
Another site’s storage.

Google VRP report 554026885: Background Fetch and site-data clearing.

A storage key went missing.
Background Fetch omitted the service worker’s StorageKey when handling the response.
The deletion reached another site.
A Clear-Site-Data response cleared the target’s first-party storage, without CORS opt-in.
The control made the difference clear.
The same response through ordinary Fetch left the target’s stored value intact.

Background Fetch:
value deleted.
Ordinary Fetch:
value preserved.

Reproduced on Chrome Canary 154 / macOS arm64. Google raised severity to S2.

Requires a target endpoint returning Clear-Site-Data. A patch was proposed; a shipped fix remains unconfirmed.

Sources: Himalaya franz, Trash 91663 (original report, 28 August), 91664 (severity raised S4 to S2), 91665 (automatic assignment), 91667 (automated potential-duplicate suggestion), 91684 (milestone 154), 91908 (6 September CodeMender proposal), and INBOX.Computer 35 (10 October milestone update). Issue title: Background Fetch CSD response clears another site's first-party storage. https://issues.chromium.org/issues/554026885 Reporter franz@bett.ag; component Blink/BackgroundFetch; type Vulnerability; severity S2; priority P2. Found in 154; milestone changed from 154 to 156. Status Assigned, limited visibility. The public tracker denied access during this review, so the dated email is the source for the status. Original test: Chrome for Testing Canary 154.0.8029.0, macOS arm64, 28 August 2026. Background Fetch: sentinel present before, null after. Ordinary Fetch control: request failed, sentinel remained present. The report identifies an omitted registration StorageKey in BackgroundFetchJobController as a missed caller of an earlier fix. An attacker needs a secure page and a target HTTPS endpoint returning Clear-Site-Data: storage. The response does not need CORS opt-in; the report says Background Fetch requires no express user permission. Impact is cross-site deletion, potentially logout and loss of persistent client data, not disclosure of the response body. The 6 September email says CodeMender uploaded a potential CL for review. It does not confirm the patch landed. An automated deduper suggested two possible duplicates; no human duplicate determination appears in the reviewed thread. Tracker OS tags: Android, Fuchsia, Linux, Mac, Windows and ChromeOS. OS tags are tracker metadata, not a claim that every platform was independently reproduced. No CVE, bounty amount, fixed version or data-exfiltration claim is established by this notification.

Software I trustedfor fifteen years.

The same loop, pointed at the banking tool on my own machine. This is where it stopped being abstract.

Browsers → Software I trusted → The kernel

Hibiscus: the software
I already trusted.

Jameica and Hibiscus had been part of my banking workflow for over 15 years.

Restore a backup.
Archive paths could escape the intended restore directory.
Import an invoice.
External XML entities enabled local file access and server-side requests.
Import application data.
XMLDecoder could turn a data import into code execution.

A familiar file
crosses a trust boundary.

Backups, invoices and saved settings are inputs, too.

Locally reproduced findings, reported 25 August 2026.

Hibiscus: finding the bug
was only the beginning.

The fix had to protect users without destroying their existing data.

Remove executable deserialization.
Read legacy wallet data without XMLDecoder; write a typed JAXB format.
Keep old wallets usable.
Preserve supported plugin data and migrate it on the next save.
Prove both sides.
Old wallet still loads. Malicious wallet is rejected without executing code.

Report.
Repair.
Retest.

The same loop, now working with the maintainer.

27 October: maintainer confirmed the final PR merged; releases were still planned.

The kernel.Where I had no business being.

Three BSD operating systems. Memory corruption in code that runs as root. The loop did not stop at the application layer.

Browsers → Software I trusted → The kernel

Three kernels, one method

The loop walked into threeoperating system kernels.

FreeBSD

A directory listing reached the kernel stack.

An overlong archive name overran a tarfs_readdir() buffer on 15.1-RELEASE / amd64.

NetBSD

A root network daemon fell to two chained bugs.

An address leak plus a label-release flaw in ldpd produced a root-owned result on MPLS / arm64.

OpenBSD

Privilege separation leaked across the boundary.

Heap and stack corruption in isakmpd and npppd crossed worker-to-monitor trust lines.

All in controlled lab setups. Several require non-default daemons, MPLS, or privileged preparation. No remote-to-root chain was demonstrated end to end.

Condensed breadth slide. Sources: FreeBSD Sent 44505 (5 Oct), 44516 (7 Oct), FreeBSD mailbox 1 (7 Oct acknowledgment); NetBSD ldpd Sent 44371 thread; OpenBSD isakmpd review and npppd three-finding report. FreeBSD: root loaded tarfs and mounted the crafted archive, vfs.usermount was 0; corruption plus a conditioned root proof, not an unprivileged-to-root exploit on a default install. NetBSD ldpd: ldpd disabled by default, MPLS required; two bugs chained to a root-owned result file; daemon ran as root. OpenBSD isakmpd: off by default; identity path selection, HASH heap overflow, over-trusting root monitor; complete remote-to-root chain not demonstrated. OpenBSD npppd: PPPoE must be enabled; pre-auth stack corruption on arm64 (amd64 negative), post-auth info leak, worker-to-monitor exposure; worker code execution remained an unproven link. Keep the honesty: these are lab findings with privileged or non-default preconditions. Do not describe them as unauthenticated internet attacks.

The deepest point

And once, the loop openedan interactive root shell.

NetBSD 11 / arm64. SCTP state-cookie handling carried attacker-controlled input into an unchecked copy inside the kernel.

Follow the input through the protocol.
A signed state cookie still carried the peer’s original, unchecked bytes.
Reach the full consequence.
The isolated test escalated a uid 1000 process to an interactive root shell.
Then run it against the fix.
The patched kernel stayed healthy and the process stayed uid 1000.

uid 1000↓uid 0

Original kernel: root shell.
Patched kernel: still uid 1000.

SCTP-enabled audit kernel, listening endpoint, QEMU guest-loopback test. A conditioned lab proof, not an independent remote exploit on a default install.

Since April · one person · one loop

From a web formto ring 0.

1Apple CVE, credited across five advisories

S2Chrome VRP report, severity raised by Google

3Hibiscus fixes merged upstream

3BSD kernels reached in the lab

1interactive root shell, proven before and after a patch

Same loop from the first half of this talk. Nothing about it was security-specific.

The research became a company.

wnry.io

The workflow from this talk,
now a security SaaS.

AI inference exclusively in Nuremberg.

Find your exposure.Discover public systems and define what to test.
Test. Verify. Retest.Recurring external pentests with expert-assessed findings.
Know what your skills run.Submit an agent skill. We audit it and automatically reverse engineer bundled binaries.

Four offers on the next slide. Pick yours first.

clawdhost.de 25 seats 1 month Starter · €10 AI budget

agent-host.net 25 seats 1 month Developer plan

2342.ai 25 vouchers €20 credit · 90 days

pwnry.io 100 audits Skills incl. bundled binaries

Everything discussed in this talk has grown into my company, Pwnry. Explain the recurring external security testing, then introduce the new skill-auditing feature: paste in a skill found online, including any bundled binaries, for automated auditing and reverse engineering. Before advancing, explain the offers so people can choose which code to scan. Clawdhost: 25 places, one free month of the Starter plan including a €10 AI budget. agent-host.net: 25 places, one free month of the Developer plan, no subscription, Free afterwards without back-billing. 2342.ai: 25 vouchers worth 20 euros each. Pwnry: 100 free skill audits. The 2342.ai voucher QR is ready; redemption opens on November 18 at 17:30. The Clawdhost voucher QR is also ready; redemption opens on November 18 at 08:00. agent-host.net redemption opens on November 18 at 08:00; its QR is live. Pwnry still shows its project logo until a redemption URL is ready.

Your next experiment starts here.

Thank you! Questions?

A few gifts for the KI Navigator crowd.

clawdhost.de

1 month free Starter plan

25 places · €10 AI budget.
3 quiz questions.

agent-host.net

1 month free Developer plan

25 places · no subscription.
3 quiz questions.

.ai

€20 in AI credit

25 vouchers · 90 days.
3 quiz questions.

pwnry.io

100 free skill audits

100 places · 90 days.
3 quiz questions.

Clawdhost, agent-host.net & 2342.ai: 25 places each · pwnry.io: 100 places · Redeem on site during KI Navigator · 3-question quiz.

Slides: no2vdp.bett.ag

Open with just the headline and introduction. Advance once to reveal all four offers and their redemption QR codes. Leave time for scanning, then advance again to change the headline to “Thank you! Questions?” and reveal the presentation QR. Leave the offers visible throughout questions. Step back once to restore the original headline and hide the presentation QR, then again to hide the offers and redemption QR codes. 2342.ai: https://2342.ai/v/ki-navigator, code ki-navigator. 25 vouchers with €20 credit each. Redemption window: November 18, 2026, 17:30 through November 19, 2026, 18:00, Europe/Berlin. The credit remains usable for 90 days after redemption. Redemption requires being within 700 m of NCC Ost / Eingang Messe Ost (49.4200, 11.1205). The quiz has three multiple-choice questions and allows three attempts per account. Talk: KI Navigator 2026 (DOAG), November 18, 17:30–18:15, room Riga, NCC Ost Nürnberg. agent-host.net: https://agent-host.net/v/ki-navigator, code ki-navigator. 25 places, 0 redeemed. Offer: one free month of the Developer plan, no subscription; afterwards Free without back-billing. Included: 3,000 browser sessions, 25,000 inbound mails, 1 GiB artefacts. Redemption window: November 18, 2026, 08:00 through November 19, 2026, 20:00, Europe/Berlin. Before November 18 at 08:00 the page shows the campaign as not yet started. Usable for one calendar month from redemption in Berlin time, so a November 18 redemption runs to December 18, 2026. Quiz: three questions, maximum three failed attempts, then the account is blocked for this campaign and the place is released. Geofence requested: 700 m around NCC Ost (49.4200, 11.1205), matching 2342.ai. pwnry.io: https://pwnry.io/v/ki-navigator, code ki-navigator. 100 places with 100 skill checks each, usable for 90 days. Redemption window: November 18, 2026, 17:30 through November 19, 2026, 18:00, Europe/Berlin, matching 2342.ai. Redemption requires being within 800 m of NCC Ost / Eingang Messe Ost (49.4200, 11.1205); GPS accuracy up to 1 km is allowed for. Quiz: the same three questions on this talk, three attempts per account. Before the window opens the page says the campaign has not started. Clawdhost: https://clawdhost.de/v/ki-navigator. 25 places, one free month of the Starter plan with €10 AI budget. Redemption window: November 18, 2026, 08:00 through November 19, 2026, 20:00, Europe/Berlin. Redemption requires being within 800 m of Messezentrum Nürnberg / NCC Ost. The quiz has three questions with four options each. The offer specifies 30 days of voucher usability after redemption.

How I Accidentally Became #2 VDP* Researcher for Germany on HackerOne

Here’s where this goes in the next 45 minutes

Franz Bettag Polyglot engineer since 2001

The ranking followed real shipped findings

One canonical backend. Distributed execution.

Central server

Agents = identity + method

Skills = composable building blocks

4 pwn hosts + shared CLI

NixOS + flakes

Validation-first state machine

Every change was a scar, not a plan

Start with the smallest useful slice

MCP was useful, then expensive

Push execution to workers

Separate agents from skills

MCP burns tokens. A CLI + skills doesn't.

Opera SIP takeover: why recon automation matters

Every session is a new hire

The whole trick: separate, gate, compose

Discovery

Execution

Validation

Composition

Feedback

Ship a CI/CD pipeline from zero to deployed

Discovery

Execution GitLab

Execution GitHub

Validation

Composition

Feedback

How to copy this tomorrow

Ship a feature with /code 9 agents. One command.

Discovery

Execution

Validation

Composition

Feedback

GitLab v15 → v18 on Kubernetes. Overnight. Unattended.

Discovery

Execution

Validation

Composition

Feedback

Don’t start with one giant prompt. Start with a loop.

Normally, this talk would end here.

The surfacea web hunter is supposed to find.

Apple: one WebKit finding.Across the platform family.

The input was web content.

The impact was memory disclosure.

The fix reached multiple products.

Chrome: a background response.Another site’s storage.

A storage key went missing.

The deletion reached another site.

The control made the difference clear.

Software I trustedfor fifteen years.

Hibiscus: the softwareI already trusted.

Restore a backup.

Import an invoice.

Import application data.

Hibiscus: finding the bugwas only the beginning.

Remove executable deserialization.

Keep old wallets usable.

Prove both sides.

The kernel.Where I had no business being.

The loop walked into threeoperating system kernels.

A directory listing reached the kernel stack.

A root network daemon fell to two chained bugs.

Privilege separation leaked across the boundary.

And once, the loop openedan interactive root shell.

Follow the input through the protocol.

Reach the full consequence.

Then run it against the fix.

From a web formto ring 0.

The research became a company.

Four offers on the next slide. Pick yours first.

Your next experiment starts here.

Thank you! Questions?

1 month free Starter plan

Ship a feature with `/code` 9 agents. One command.

Apple: one WebKit finding.
Across the platform family.

Chrome: a background response.
Another site’s storage.

Hibiscus: the software
I already trusted.

Hibiscus: finding the bug
was only the beginning.