Hunting on public and private programs since June 2022, with reputation 182 and signal 4.6. Thanked by Vercel, Toyota, X / xAI and Live Nation; ranked #2 on a private program; a publicly disclosed access-control report at Vercel ($1,026). Also paid on Intigriti.
KELLY BLUE BUG HUNTER
Bug bounty hunter on HackerOne as qub (formerly kelly-blue), focused on broken access control — the checks that decide who is allowed to see what. I find where they fail so teams can fix them first.
About Kelly
I've been hunting on HackerOne since 2022 — today as qub, before that as kelly-blue — on public and private programs, with a focus on web applications, APIs and access control. When I'm not hunting, I build the tools I hunt with: I'm the founder of KellyBlue, a recon automation platform for authorized security testing. I'm also a Christian apologist and content creator — two worlds that share more than you'd think.
"REVOKED ACCESS
SHOULD STAY
REVOKED."
My favourite findings are the ones where authorization quietly fails: tokens that outlive the access they were issued for, permissions that are checked only after the data has already been handed over, and private resources that stay reachable after someone was removed.
Programs that have thanked me include Vercel, Toyota, X / xAI and Live Nation, plus private programs — on one of them I'm ranked #2. Every report I send includes a clear proof of concept, the real impact and how to fix it: reproducible issues, not noise.
Off the keyboard, I'm a Christian apologist and content creator. I produce videos, articles, and teaching resources that make the case for Christianity — helping people think clearly about faith, reason, and the questions that matter most. Whether I'm tracing a vulnerability or tracing an argument, the work is the same: find the flaw, show why it matters, and point to what's true.
Expertise
SKILLS
- Broken Access Control & Authorization
- Web Application Testing
- API Security Testing
- Session & Token Handling
- Reconnaissance & Asset Discovery
- Recon Automation & Tooling
- Impact Analysis & Proof of Concept
- Clear, Reproducible Reports
Career
WORK
EXPERIENCE
Building KellyBlue, a recon automation platform for authorized security testing: scanners in isolated containers, chainable workflows, scope enforcement, and AI agents that can drive it over MCP.
HackerOne
BADGES
Publish or Perish
HackerOne
Publicly disclosed a report.
Community Milestone Program — Levels 1, 2 & 3
HackerOne
Reached Level 3 of HackerOne's Community Milestone Program for 2025–2026.
A5: Broken Access Control
HackerOne
Reported a valid Broken Access Control vulnerability.
Bounty Hunter
HackerOne
First bounty received.
Streaker
HackerOne
Two reports in a row were closed as resolved.
Good Samaritan
HackerOne
Resolved a report with a team that doesn't pay bounties.
Insecticide
HackerOne
First report closed as resolved.
Receipts
PROOF OF
IMPACT
Recognition
THANKED BY
Vercel
Rank #67 · 24 reputation · disclosed report
Toyota
Rank #91 · 21 reputation
Private program
Rank #2 · 21 reputation
Private program
Rank #67 · 22 reputation
X / xAI
2 reputation
Live Nation
Rank #100 · 2 reputation
Contact