Profile Photo

Insha Jabeen

I'm the face behind Medusa — a cybersecurity media brand focused on web and API security. I hunt vulnerabilities on HackerOne, turn real findings into content that 40,000+ subscribers actually learn from, and work with companies on sponsored content, product demos, and technical writing. Here's my blogging site: medusa0xf.com

About me

I'm Insha, the Security Researcher and creator behind Medusa — a cybersecurity media brand built around web application, API and AI security.

On the research side, I have hands-on experience conducting internal penetration tests, API security assessments, and technical report writing through my internship at Traceable with Harness. I worked with tools like Traceable Sonar to analyze API traffic, uncover vulnerabilities, and deliver detailed remediation steps. I also actively hunt on HackerOne and share my findings publicly so others can learn from them.

On the content side, I spent over 1.5 years as a Content Writer at Akto, producing technical guides for engineers, pentesters, and developers on API security and web vulnerabilities. Through Medusa, I've grown that further, creating YouTube videos, detailed write-ups, and hosting the Snake Bytes podcast, where I break down real-world attacks and security concepts for a community of 40,000+ subscribers and growing.

Projects

Project

A detailed write-up of how I uncovered an Insecure Direct Object Reference (IDOR) vulnerability in a delivery app that earned a $3000 bounty. This article walks through my approach, the tools I used, and the techniques applied, making it a practical learning resource for both hackers and developers.

How I Found a $3000 IDOR Vulnerability in a Delivery App

Introduction: Recently, I was hunting on a target that I can't disclose because of its responsible disclosure program, even though it's public...

Preview Image
Read

Project

A practical video guide on misconfigured AWS S3 buckets — one of the most common cloud security issues and a prime target for bug bounty hunters. In this video, I explain how S3 buckets work, the mistakes developers often make, and how attackers exploit them, with real-world examples and testing techniques you can apply.

Project

A complete video guide to OAuth 2.0 flows, explained with real examples from Okta and OAuth Playground. This walkthrough covers how each flow works, common security pitfalls, and practical testing tips, perfect for bug bounty hunters, pentesters, and developers looking to strengthen their understanding of OAuth.

Project

An episode of my Snake Bytes podcast diving into Dependency Confusion — the supply chain attack that let a researcher slip malicious packages into companies like Microsoft, Apple, and PayPal. I unpack how the hack worked, why it was so impactful, and what both hackers and developers can learn from it.

You can listen to the full episode on Spotify

Listen on spotify

Tweets

Contact