Transmissions

Field Notes

Build logs, AI notes, and occasional opinions from the motionLabs team — the things we figured out while solving genuinely hard problems.

Bybit's /user_check Endpoint, and the Word 'Not Applicable'

I reported an authenticated email enumeration bug on bybit.com that leaks KYC status and internal user IDs. HackerOne closed it as Not Applicable. Here's the write up and why I think they got it wrong.

securitybug-bountywriteup

First transmission from motionLabs. We're going to write here when we have something worth saying — about hard problems, AI, and the work.