Skip to content
pwnry. io
Start free
← Research and evidence

From a lead to a substantiated finding.

Case study: Franz Bettag’s own platform for AI-assisted security research.

#2 VDP Security Researcher Germany · HackerOne · Q1/2026

The task: verify suspected vulnerabilities in practice.

Large attack surfaces produce many leads. A technical signal, an AI response or a suspected attack chain does not establish a reportable finding. Franz Bettag’s research platform separates investigation, independent checking and documentation.

Franz designs, develops and operates the platform himself: its backend, tools, workflows and expert review of results. This case study describes his own research work.

  1. Investigate

    Specialized checks investigate authorized systems. The agreed scope and appropriate reporting channel guide the work.

  2. Reproduce again

    An independent check attempts to reproduce the finding in practice. Unclear, unstable or unsupported results return for further review.

  3. Assess impact

    Confirmed findings are examined for their actual impact. Connections require technical evidence; a theoretical chain alone is insufficient.

  4. Document and improve

    A report connects reproducible steps, evidence and a justified assessment. Feedback and new evidence inform further work.

Opera: DNS dependencies reaching into telephony.

The talk describes dangling SRV references associated with Opera’s SIP/VoIP infrastructure. An abandoned external domain dependency enabled a takeover. Franz Bettag confirmed the case manually and reported it through Bugcrowd.

For discovery, that means including legacy DNS dependencies and services beyond the web server. The slides also document three subdomain-takeover cases in Amazon’s VDP.

See the Opera case and other talk examples

The ranking as public evidence.

The event listing for the talk on 16 April 2026 describes Franz Bettag as Germany’s #2 VDP researcher on HackerOne for January to March 2026. The original screenshot preserved on Pwnry shows fbettag in second place.

View the ranking and original evidence

What this means for your pentest.

Pwnry brings this research experience to recurring external pentests: a verified scope, substantiated findings and concrete remediation steps. Expert assessment remains part of the contracted service.

Pwnry follows its own location policy for AI-assisted analysis: inference exclusively in Nuremberg. The free company check is a bounded starting point; full pentests and retests are commissioned within an agreed scope.

Start your company security check External penetration tests