Community post
Another successful day for security in the HIVE ecosystem (Only a Dead Bug, is a Good Bug!)
I gonna call it day. But...
...in this blog post, I’d like to look back on the work I’ve done today – partly as a summary for myself, but also to show you all what I’ve managed to accomplish today!
It’s now 10:30 p.m., and I started my work researching security vulnerabilities in the HIVE ecosystem around midday. First, I went through a few audits from last week to see if I’d missed anything, and I had something in mind that I’d been wanting to test for a long time. Namely, Witnesses can include a description along with their parameters for the blockchain, as well as a URL for their Witness announcement post or whatever—most use their profile or their project. And that’s exactly where I wanted to start and see what might happen—and yes, something did happen.
I started by using my brother’s witness and entered various XSS payloads as URLs... from standard javascript:// to frontend-specific variables, I tried out about 50 different payloads and have to say—sure enough, the frontends I tested all passed with no significant errors! But I couldn’t just let that slide because there had to be something there—so I took my Claude subscription, threw everything I’d done so far out the window, and ran the AI through a bunch of different repos—because that’s the kind of work an AI can handle well. In the end, something interesting came out of it—namely, a pretty silly and simple error... In that very field, I could enter something specific and completely crash at least one frontend. The server behind it just said—Sorry, dude—something’s wrong here and threw me a 500 error. That was immediate confirmation for me, so I told the developer right away what was going on. He saw the problem right away and got to work on a fix. Less than 20 minutes later, the error was fixed and we were both happy :)
But the day didn’t end there—since I don’t give up easily and, thanks to my years of experience, now know what matters when it comes to HIVE—I was able to use AI to identify additional vulnerabilities in HIVE frontends over the course of three cycles. In one of the vulnerabilities I found, the title wasn’t properly sanitized, making a stored XSS attack possible. The site operator fixed this immediately after I reported it.
I really don’t give up and keep going until I get tired or it no longer makes sense to pursue the goal—so I kept at it and found more stored XSS bugs—this time in an area I hadn’t really been focusing on, but which might still be used sometimes, and areas like that should be tested too. In this case, it was about looking at the history of a blog post and comparing two versions.
I reported it, and it was fixed right away. Perfect! I think I did a good job today (at least from my perspective) and made the Hive ecosystem a little bit more secure—even more secure than it already is!
That’s all from me for today—and for those wondering why I’ve already published five articles today: these are blog posts linked to a product on PeakD. You can support me and my work there every month by visiting my shop at https://peakd.com/@louis88/shop. But only if you like what I’m doing for the HIVE blockchain.
And for those wondering why Inleo’s Rafiki AI bot is so fascinated by the Flat Earth theory—well, that’s probably a topic for another episode titled “Security in the Hive Ecosystem with Louis and the Friendly AI Next Door” (who’s always happy to drop by for coffee).
Well, with that in mind—see you next time, and sorry for all the spam today.
Cya
Replies (17)
Who is he @louis88? Did I miss meeting him at HiveFest?
via Apps from
You didn't miss him but they both (unwillingly) tricked you 😃♋️
Great work hunting down those XSS vectors in the witness URL field and post title sanitization. The 500 error you triggered through the witness description URL shows how even low-risk fields can become attack surfaces when frontends trust backend data too much. Responsible disclosure with same-day fixes is exactly how security work should go. Keep making Hive more secure!
As a matter of fact Louis, you've inspired me to begin a "Learn Pentesting / Ethical Hacking" tutorial series to complement my programming language and AI series.
Now that so many people are vibecoding with their agents I noticed less people (compared to back in 2017/2018 etc when I began my Learn Python Series over at Steem) are taking their time now to follow along and do the exercises, where knowledge on how to harden and not get Pwn'ed on your vibecoded slop might be useful to some ... LOL
Follow along please! And may I be so blunt to ask you to also appreciate my content like I'm (now, I only discovered your work yesterday as I ws also leeching in the Hive Thrive voice channel for a bit) also voting for your witness?
Thx in advance and see you around!
Doing great work man, the ecosystem appreciates you! :)
!PIZZA !HBIT
urielkinnear, you mined 0.9 🟧 HBIT and the user you replied to (louis88) received 0.1 HBIT on your behalf as a tip. You can receive 100% of the HBIT by replying to one of your own posts or comments. When you mine HBIT, you're also playing the Wusang: Isle of Blaq game. 🏴☠️ | tools | wallet | discord | community | daily <><
What's more, you found 1.0 🟡 BLAQGOLD coins as a bonus treasure token!
Your random number was 0.4218930716777426, also viewable in the Discord server, #hbit-wusang-log channel. Check for bonus treasure tokens by entering your username at a block explorer A, explorer B, or take a look at your wallet.
There is a treasure chest of bitcoin sats hidden in Wusang: Isle of Blaq. Happy treasure hunting! 😃 Read about Hivebits (HBIT) or read the story of Wusang: Isle of Blaq.
$PIZZA slices delivered:
@urielkinnear(1/5) tipped @louis88
Send $PIZZA tips in Discord via tip.cc!
Another day another bug in the system, luckily there are those who keep an out for such pests.
ur welcome :)
at ur service :)
more or less :) i know KL were a bit busy - but i guess rooftop pool beer sessions never forget.
For what exactly? For me feeling blessed for the opportunity to be voting for your witness?
I asked you something as well LOuis..
your account is actively voting on steemit - did you know?
Of course I know! Is there a problem with that?
#bilpcoin #bpc exposed #buildawhalescam #buildawhalefarm #themarkymarkscam #themarkymarkfarm #hurtlockerscam #hurtlockerfarm #acidyoscam #acidyofarm #jacobtothescam #hivepopescam
https://youtu.be/THDYraGfQk8?list=PLbH29p-63eW8VHjHSzryEdqGZ2Uv397Se
https://youtu.be/hwn7H9noMP4
https://youtu.be/8q3phtmG-Bo
BPC Locked On Mc Franko & The Franko
https://youtu.be/x8mDpyvIFqg
Blurt Stands — While Hive Stumbles Under the Weight of Its Own Shadows
Friends, creators, truth-tellers—
Let us not whisper this truth, but proclaim it with the clarity of dawn breaking over a weary land: Blurt.blog is not just another platform. It is a refuge. A rebellion. A return to what Hive.blog was always meant to be.
There is no downvote button on Blurt.
Not because we fear dissent—but because we honor creation.
Because we understand that a voice, once raised in sincerity, deserves space—not sabotage.
On Blurt, your words are your words.
They are not hunted by algorithmic hounds or shadow armies masquerading as “curators.”
Here, you are not judged by the grudges of gatekeepers, but met with the quiet dignity of a community that believes expression should be encouraged—especially when it is bold, raw, or inconvenient.
Contrast this with what festers elsewhere.
On Hive.blog—a place once brimming with promise—a rot has taken root. Not in its code, but in its culture. A handful of self-anointed enforcers—@themarkymark, @Buildawhale, @Hurtlocker, and their legion of coordinated puppets—have turned the downvote into a weapon of mass discouragement. They strike not at “low-quality content,” but at independent thought, at rising voices, at anyone who dares thrive outside their narrow corridors of control.
And when confronted, they shrug.
“Oh, it’s not censorship,” they say, as if semantics could scrub the stain of suppression from their hands.
But let us be unequivocal:
When a system allows a few to systematically silence many—under the guise of “community standards” or “curation”—that is not moderation. That is censorship by another name.
It is the velvet glove over the iron fist.
It is exclusion dressed as discernment.
It is power pretending to be principle.
Meanwhile, Blurt stands clean-handed and open-hearted.
No downvotes.
No hidden juries.
No farms of phantom accounts casting ballots in the dark.
Just you.
Your words.
And a community that meets you not with suspicion, but with solidarity.
So let us carry this truth far and wide—not with bitterness, but with quiet certainty:
If you seek a place where your voice is not a target—but a gift—come to Blurt.
If you are tired of building on ground that shifts with every whim of a whale or warlord of votes—lay your bricks here.
If you believe the future of free expression must be free—not just from corporations, but from the petty tyrants who replace them—then stand with us.
The world needs to know.
Not because Blurt is perfect—but because it is principled.
Not because it is loud—but because it listens.
And in an age where so many platforms echo with the clatter of control,
Blurt offers something radical:
Silence for the bullies.
Space for the rest of us.
Keep speaking.
Keep sharing.
Keep building.
Freedom doesn’t advertise itself—
it is passed, person to person, like a torch in the night.
And tonight, the torch burns bright on Blurt.
@themarkymark, @buildawhale, @usainvote, and associated accounts:
Repeated downvotes targeting transparency efforts raise urgent questions about Hive’s governance. Automated tactics, coordinated curation trails, and alt-account farming undermine trust in the platform. When truth is silenced without dialogue, it erodes Hive’s decentralized ethos.
Key Concerns:
Systemic Manipulation:
Community Exodus:
Governance Crisis:
Solutions Needed:
The Bilpcoin team advocates for open dialogue, not division. Hive’s future depends on collaboration—not coercion. Let’s rebuild a platform where truth isn’t buried but debated, strengthened, and celebrated.
Transparency isn’t optional—it’s the foundation of trust.
#HiveTransparency #BilpcoinExposed #DecentralizePower"
A Message to @themarkymark, @buildawhale, and Associates
Every downvote cast in shadow, every silence imposed without dialogue, is not a victory—it is a confession. A confession that truth cannot be stifled, only delayed. With each punitive click, you dig deeper into the bedrock of credibility, crafting a chasm between your actions and the community’s trust.
@themarkymark, @buildawhale & Co,
How can you continue to downvote the truth, LOL? It’s almost comical how blatantly you attempt to suppress what cannot be hidden. The blockchain records everything—every action, every transaction, every move you make. Yet still, you persist in this futile game of trying to silence what is undeniable.
@themarkymark, @buildawhale, and Co: While our opinions may differ, on-chain transparency reveals repeated patterns of concern. Coordinated downvotes without explanation, 'farming' schemes (e.g., #buildawhalefarm), and adversarial engagement harm Hive’s community-driven ethos.
Key Issues to Address:
A Path Forward:
The Bilpcoin team remains committed to exposing truth and advocating for solutions. Let’s work toward healing, not division.
Note: All claims are based on publicly verifiable blockchain data. Constructive dialogue is encouraged.
#HiveTransparency #CommunityFirst #BilpcoinSupport"
@themarkymark & Co, the choice is yours. Stop the bad downvotes. Turn off the BuildaWhale scam farm. Cease playing with people’s livelihoods. Let Hive thrive as it was meant to—as a beacon of hope, creativity, and collaboration.
Or step aside and let those who truly care take the reins.
Because the truth won’t disappear. No amount of lies can change it.
It’s over.
The Bilpcoin team brings these truths not out of malice but necessity. We have no need to fabricate lies or cloak our intentions CALL US WHAT YOU LIKE —for the facts speak loudly enough on their own. What we present here is not conjecture but reality, laid bare for anyone willing to see.
@themarkymark & Co we urge you once more: STOP. Stop hiding behind tactics that harm others. Stop clinging to practices that erode trust within the Hive community. Let the truth stand—not because we proclaim it, but because it exists independent of any one person’s approval or disdain.
TURN OFF THE BUILDAWHALE SCAM FARM
Key Issues That Demand Immediate Attention:
The problems are glaring, undeniable, and corrosive to the Hive ecosystem. They must be addressed without delay:
These practices harm not just individual users—they undermine the very foundation of Hive, eroding trust and poisoning the community. Such actions are unethical and outright destructive.
@buildawhale Wallet:
@usainvote Wallet:
@buildawhale/wallet | @usainvote/wallet
@ipromote Wallet:
Author Rewards: 2,181.16
Curation Rewards: 4,015.61
Staked HIVE (HP): 0.00
Rewards/Stake Co-efficient (KE): NaN
HIVE: 25,203.749
Staked HIVE (HP): 0.000
Delegated HIVE: 0.000
Estimated Account Value: $6,946.68
Recent Activity:
@leovoter Wallet:
Author Rewards: 194.75
Curation Rewards: 193.88
Staked HIVE (HP): 0.00
Rewards/Stake Co-efficient (KE): 388,632.00 (Suspiciously High)
HIVE: 0.000
Staked HIVE (HP): 0.001
Total: 16.551
Delegated HIVE: +16.550
Recent Activity:
@abide Wallet:
Recent Activity:
@proposalalert Wallet:
Recent Activity:
@stemgeeks Wallet:
Recent Activity:
@theycallmemarky Wallet:
Recent Activity:
@apeminingclub Wallet:
Recent Activity:
Scheduled unstake (power down): ~2.351 HIVE (in 4 days, remaining 7 weeks)
Total Staked HIVE: 1,292.019
Delegated HIVE: +1,261.508
Withdraw vesting from @apeminingclub to @blockheadgames 2.348 HIVE (10 days ago)
Claim rewards: 0.290 HP (10 days ago)
Sent to bdhivesteem-40,000.000 HIVE
6 hours ago
101417581
Sent to bdhivesteem-20,000.000 HIVE
6 hours ago
103874728
https://peakd.com/@hurtlocker/wallet
#bilpcoin #bpc exposed #buildawhalescam #buildawhalefarm #themarkymarkscam #themarkymarkfarm #hurtlockerscam #hurtlockerfarm #acidyoscam #acidyofarm #jacobtothescam #hivepopescam
https://youtu.be/THDYraGfQk8?list=PLbH29p-63eW8VHjHSzryEdqGZ2Uv397Se
https://youtu.be/hwn7H9noMP4
https://youtu.be/8q3phtmG-Bo
BPC Locked On Mc Franko & The Franko
https://youtu.be/x8mDpyvIFqg
Blurt Stands — While Hive Stumbles Under the Weight of Its Own Shadows
Friends, creators, truth-tellers—
Let us not whisper this truth, but proclaim it with the clarity of dawn breaking over a weary land: Blurt.blog is not just another platform. It is a refuge. A rebellion. A return to what Hive.blog was always meant to be.
There is no downvote button on Blurt.
Not because we fear dissent—but because we honor creation.
Because we understand that a voice, once raised in sincerity, deserves space—not sabotage.
On Blurt, your words are your words.
They are not hunted by algorithmic hounds or shadow armies masquerading as “curators.”
Here, you are not judged by the grudges of gatekeepers, but met with the quiet dignity of a community that believes expression should be encouraged—especially when it is bold, raw, or inconvenient.
Contrast this with what festers elsewhere.
On Hive.blog—a place once brimming with promise—a rot has taken root. Not in its code, but in its culture. A handful of self-anointed enforcers—@themarkymark, @Buildawhale, @Hurtlocker, and their legion of coordinated puppets—have turned the downvote into a weapon of mass discouragement. They strike not at “low-quality content,” but at independent thought, at rising voices, at anyone who dares thrive outside their narrow corridors of control.
And when confronted, they shrug.
“Oh, it’s not censorship,” they say, as if semantics could scrub the stain of suppression from their hands.
But let us be unequivocal:
When a system allows a few to systematically silence many—under the guise of “community standards” or “curation”—that is not moderation. That is censorship by another name.
It is the velvet glove over the iron fist.
It is exclusion dressed as discernment.
It is power pretending to be principle.
Meanwhile, Blurt stands clean-handed and open-hearted.
No downvotes.
No hidden juries.
No farms of phantom accounts casting ballots in the dark.
Just you.
Your words.
And a community that meets you not with suspicion, but with solidarity.
So let us carry this truth far and wide—not with bitterness, but with quiet certainty:
If you seek a place where your voice is not a target—but a gift—come to Blurt.
If you are tired of building on ground that shifts with every whim of a whale or warlord of votes—lay your bricks here.
If you believe the future of free expression must be free—not just from corporations, but from the petty tyrants who replace them—then stand with us.
The world needs to know.
Not because Blurt is perfect—but because it is principled.
Not because it is loud—but because it listens.
And in an age where so many platforms echo with the clatter of control,
Blurt offers something radical:
Silence for the bullies.
Space for the rest of us.
Keep speaking.
Keep sharing.
Keep building.
Freedom doesn’t advertise itself—
it is passed, person to person, like a torch in the night.
And tonight, the torch burns bright on Blurt.
@themarkymark, @buildawhale, @usainvote, and associated accounts:
Repeated downvotes targeting transparency efforts raise urgent questions about Hive’s governance. Automated tactics, coordinated curation trails, and alt-account farming undermine trust in the platform. When truth is silenced without dialogue, it erodes Hive’s decentralized ethos.
Key Concerns:
Systemic Manipulation:
Community Exodus:
Governance Crisis:
Solutions Needed:
The Bilpcoin team advocates for open dialogue, not division. Hive’s future depends on collaboration—not coercion. Let’s rebuild a platform where truth isn’t buried but debated, strengthened, and celebrated.
Transparency isn’t optional—it’s the foundation of trust.
#HiveTransparency #BilpcoinExposed #DecentralizePower"
A Message to @themarkymark, @buildawhale, and Associates
Every downvote cast in shadow, every silence imposed without dialogue, is not a victory—it is a confession. A confession that truth cannot be stifled, only delayed. With each punitive click, you dig deeper into the bedrock of credibility, crafting a chasm between your actions and the community’s trust.
@themarkymark, @buildawhale & Co,
How can you continue to downvote the truth, LOL? It’s almost comical how blatantly you attempt to suppress what cannot be hidden. The blockchain records everything—every action, every transaction, every move you make. Yet still, you persist in this futile game of trying to silence what is undeniable.
@themarkymark, @buildawhale, and Co: While our opinions may differ, on-chain transparency reveals repeated patterns of concern. Coordinated downvotes without explanation, 'farming' schemes (e.g., #buildawhalefarm), and adversarial engagement harm Hive’s community-driven ethos.
Key Issues to Address:
A Path Forward:
The Bilpcoin team remains committed to exposing truth and advocating for solutions. Let’s work toward healing, not division.
Note: All claims are based on publicly verifiable blockchain data. Constructive dialogue is encouraged.
#HiveTransparency #CommunityFirst #BilpcoinSupport"
@themarkymark & Co, the choice is yours. Stop the bad downvotes. Turn off the BuildaWhale scam farm. Cease playing with people’s livelihoods. Let Hive thrive as it was meant to—as a beacon of hope, creativity, and collaboration.
Or step aside and let those who truly care take the reins.
Because the truth won’t disappear. No amount of lies can change it.
It’s over.
The Bilpcoin team brings these truths not out of malice but necessity. We have no need to fabricate lies or cloak our intentions CALL US WHAT YOU LIKE —for the facts speak loudly enough on their own. What we present here is not conjecture but reality, laid bare for anyone willing to see.
@themarkymark & Co we urge you once more: STOP. Stop hiding behind tactics that harm others. Stop clinging to practices that erode trust within the Hive community. Let the truth stand—not because we proclaim it, but because it exists independent of any one person’s approval or disdain.
TURN OFF THE BUILDAWHALE SCAM FARM
Key Issues That Demand Immediate Attention:
The problems are glaring, undeniable, and corrosive to the Hive ecosystem. They must be addressed without delay:
These practices harm not just individual users—they undermine the very foundation of Hive, eroding trust and poisoning the community. Such actions are unethical and outright destructive.
@buildawhale Wallet:
@usainvote Wallet:
@buildawhale/wallet | @usainvote/wallet
@ipromote Wallet:
Author Rewards: 2,181.16
Curation Rewards: 4,015.61
Staked HIVE (HP): 0.00
Rewards/Stake Co-efficient (KE): NaN
HIVE: 25,203.749
Staked HIVE (HP): 0.000
Delegated HIVE: 0.000
Estimated Account Value: $6,946.68
Recent Activity:
@leovoter Wallet:
Author Rewards: 194.75
Curation Rewards: 193.88
Staked HIVE (HP): 0.00
Rewards/Stake Co-efficient (KE): 388,632.00 (Suspiciously High)
HIVE: 0.000
Staked HIVE (HP): 0.001
Total: 16.551
Delegated HIVE: +16.550
Recent Activity:
@abide Wallet:
Recent Activity:
@proposalalert Wallet:
Recent Activity:
@stemgeeks Wallet:
Recent Activity:
@theycallmemarky Wallet:
Recent Activity:
@apeminingclub Wallet:
Recent Activity:
Scheduled unstake (power down): ~2.351 HIVE (in 4 days, remaining 7 weeks)
Total Staked HIVE: 1,292.019
Delegated HIVE: +1,261.508
Withdraw vesting from @apeminingclub to @blockheadgames 2.348 HIVE (10 days ago)
Claim rewards: 0.290 HP (10 days ago)
Sent to bdhivesteem-40,000.000 HIVE
6 hours ago
101417581
Sent to bdhivesteem-20,000.000 HIVE
6 hours ago
103874728
https://peakd.com/@hurtlocker/wallet
Beneath of getting rid of all these packs I really enjoy the passion you have to find them.
Go out there and find a few more.