Bug bounty hunting is often portrayed as methodical recon, crafted payloads, and targeted testing. But sometimes, the most interesting vulnerabilities don’t come from planned attacks — they come from the chaos. In this talk, I’ll walk through a handful of real bugs I’ve reported over the years that found me instead. From unexpected blind XSS triggers in places I wasn’t even actively testing, to getting quietly added to internal distribution lists and receiving sensitive data I never asked for, to those classic “WTF” moments that every seasoned hunter has experienced — this talk highlights the unpredictable and serendipitous side of bug bounty. We’ll explore how these moments happened, what they revealed about the systems in question, and what they taught me about staying alert beyond traditional recon. Whether you’re an experienced hunter or just getting started, this talk is a reminder that in bug bounty, sometimes the best findings aren’t hunted — they’re stumbled into. Jasmin Landry is a seasoned ethical hacker and full-time bug bounty hunter who has reported hundreds of security vulnerabilities to some of the world’s largest tech companies. After years leading cybersecurity efforts as Senior Director of Information Security at Nasdaq, Jasmin returned to his roots in hacking — now focusing exclusively on uncovering critical bugs through bug bounty platforms. Recognized at multiple live hacking events for top findings, he brings a sharp eye for unexpected issues and a deep understanding of modern attack surfaces. He’s also a co-leader of OWASP Montréal and an active voice in the security research community.