TumarOne platform (official channel)

2026 Season 3 is over!

Here are the hunters who came out on top:

🥇 mukh4w
🥈 nov3mber
🥉 plrF

Thank you all for the relentless hunting and the support.

Can't wait to see who will dominate Season 4 😃

🔗 Hunt now

QazNet Monthly Cyber Threat Analytics Digest: April Edition

April had it all – .env files in web roots, debug modes left on in prod, open database dumps.

Month two, pattern holds – critical incidents rooted not in zero-days, but in configurations that should have been locked down on day one. This month we're also adding two new sections: a breakdown of critical cases and a bug hunter checklist – both in the cards above. 👆

😃 As always, stay tuned with tumar.one.

You've been waiting for this 👀

Wake up researchers, the Kaspi.kz program's bounty just got doubled.
500 000 KZT is now on the table.

No excuse not to hunt.
😃 Start Now

One day, vibe coders will learn not to push .env files. Until then - we'll keep the stats coming.

Over the past month, we analyzed a large number of reports from the Kazakhstan internet segment and spotted some clear trends we'll now be sharing regularly. And, oh boy, the majority of critical issues come not from sophisticated cyberattacks, but from basic negligence during development and server configuration.

The full breakdown — top vulnerability categories, examples, and a developer checklist — is in the cards above. 👆

Remember, cyber hygiene is not a one-time campaign, but a continuous process.
Stay safe and stay tuned with tumar.one.