The UI Is the Lie: Hunting Bugs Hidden in JavaScript Bundles

Every JavaScript bundle your browser downloads contains the app's entire client-reachable API surface — including the endpoints no button ever links to. In this talk, we'll show how to read that surface systematically: hidden admin routes, leaked secrets, and real bug-bounty findings, using BundleBleed, an open-source triage tool we built. Expect a live demo, real (anonymized) HackerOne bugs, and hands-on labs the room can break themselves.