TumarOne platform (official channel)

Limited time only! 🔥

Kcell Doubles Bug Bounty Rewards for Critical Vulnerabilities: Up to 1,000,000 KZT

September is National Cybersecurity Month in Kazakhstan, and Kcell is marking it in the way researchers appreciate most.

From September 1 to 30, the maximum reward for an eligible critical vulnerability on the Tumar.One platform doubles to 1,000,000 KZT. The scope stays wide open: all Kcell and activ domains and subdomains.

Reports must be submitted by September 30. Payouts follow the program terms: the reward applies to a confirmed vulnerability that meets the program conditions, and the final amount is set on triage.

Start hunting!

📋 New on Tumar.One: Report Limits
 
We are rolling out report submission limits across the platform.
 
Your limit is individual - it depends on the quality of your past reports. The default is 5 active reports at a time. Submit consistently good work and we'll raise it. Submit noise and it goes down.
 
Once a report moves out of New status, a slot opens up and you can submit again.

Hunt smart!

Hey researcher 👋
 
We'd like to invite you to KazHackStan - the biggest hacker conference in Central Asia, bringing together over 6,000 attendees, top security researchers, and leading experts in information security.
 
The Top 10 researchers of Tumar.One will be invited on stage at KazHackStan - where they will be awarded with merch and named awards!
 
Reports are accepted through and including September 15th.
 
🎟 Exclusive Promo Code
8DNLG0SN3B
 
50% discount on tickets - limited to 50 users. First come, first served.

KazHackStan 2026 Executive Sponsor - Tumar.One 🔥

Tumar.One - Орталық Азиядағы 4 000-нан астам этикалық хакерді біріктіретін ең ірі баг-баунти платформасы.

Платформа CyberKumbez үшін есептерді қабылдау мен модерациялауды қамтамасыз етеді, сондай-ақ 2027 жылғы киберқауіпсіздік бойынша ICO халықаралық олимпиадасына Қазақстан құрамасын ұлттық іріктеуден өткізу үшін T1CTF платформасын ұсынады.

KazHackStan 2026-ға қолдау көрсеткені үшін Tumar.One-ға алғысымызды білдіреміз 🔐

KazHackStan 2026 Executive Sponsor - Tumar.One 🔥

Tumar.One - крупнейшая баг-баунти платформа Центральной Азии, объединяющая более 4 000 этичных хакеров.

Платформа обеспечивает приём и модерацию отчётов для CyberKumbez, а также предоставляет платформу T1CTF для национального отбора в сборную Казахстана на Международную олимпиаду по кибербезопасности ICO 2027.

Благодарим Tumar.One за поддержку KazHackStan 2026 🔐

KazHackStan 2026 Executive Sponsor - Tumar.One 🔥

Tumar.One is Central Asia’s largest bug bounty platform, bringing together more than 4,000 ethical hackers.

The platform handles report submission and moderation for CyberKumbez and also provides the T1CTF platform for Kazakhstan’s national selection process for the team that will represent the country at the 2027 International Cybersecurity Olympiad (ICO).

We thank Tumar.One for supporting KazHackStan 2026 🔐

The vulnerabilities in June and July weren't clever...
 
Because they didn't need to be. Unverified signatures, client-supplied prices, open Redis instances, outdated CMS handing out root shells. 89% of critical findings this cycle came from systems that simply trusted the wrong input.
 
This digest covers June and July combined. Full breakdown - categories, hunter checklist, developer checklist - in the cards above. 👆
 
Stay tuned tumar.one 😃

Important Rules Update
 
We have updated the Tumar.One platform rules - and there are quite a few changes.💥
 
Before your next submission, please make sure you're up to date.
 
😃 check here.

May broke the pattern.

For two months, the story was the same - .env files, debug modes, open databases. You know, basic negligence. In May, the attack surface shifted: AI infrastructure, secrets buried in React bundles, JWT confusion across microservices, and fresh CVEs being weaponized the same week they drop.

Full breakdown - top incident categories, critical cases, and checklists for both hunters and developers - all in the cards above. 👆

Stay tuned with tumar.one 😃