From Critical Find to Full Scholarship: How Sylvester Jusu Earned His Seat at AfricaHackon Academy Cohort 7

A Critical severity report is the kind of find that makes a triage team sit up straight. On July 25, HackerSavanna researcher Sylvester Jusu (@Debiansl) filed exactly that kind of report against the platform's own Vulnerability Disclosure Program, and turned it into a fully funded seat at one of East Africa's most respected security training programs.

The reward

Courtesy of Cyber Guard Africa and AfricaHackon, Sylvester has been awarded a full, no-cost scholarship to AfricaHackon Academy Cohort 7, the six-month, hands-on cybersecurity bootcamp covering network security, cryptography, OSINT, DevSecOps, incident response, GRC, and mobile and web security, complete with a certification on completion.

It's exactly the kind of recognition HackerSavanna's Vulnerability Disclosure Program exists to create: real findings, from real researchers, rewarded with more than just a line item on a leaderboard.

The finding

Sylvester's report, now fully remediated and publicly disclosed on SavannaHub, identified a Critical Firestore Security Rules misconfiguration on the HackerSavanna platform itself.

In short: the platform's Firestore database security rules were misconfigured in a way that allowed any authenticated user, including a brand-new account created in seconds through the public signup flow, to read data far beyond what they should ever have had access to. Because Firebase account creation requires no email verification and no manual approval, this meant the barrier between "anonymous visitor" and "user with broad read access to the platform's own data" was effectively a single, trivial API call.

The technical chain Sylvester demonstrated was refreshingly simple, which is exactly why it was so serious:

1. Create a Firebase account through the platform's own public API key, no CAPTCHA, no verification, no web signup form required.
2. Exchange that signup response for a valid Firebase ID token.
3. Use that token to query Firestore's REST API directly, reading collections the requesting user had no legitimate business accessing.

Write access was correctly locked down (every write attempt was properly rejected), which limited the blast radius to a read-only exposure. But a read-only exposure of this breadth, touching user records, vulnerability reports, and program data, is still a Critical-severity problem: it's the kind of gap that turns "we have an access control model" into "we have an access control model with a hole in it big enough for anyone to walk a brand-new, unverified account straight through."

What we did about it

HackerSavanna's security team validated the finding, tightened the affected Firestore security rules, and re-tested the exact reproduction steps Sylvester provided to confirm the gap was fully closed. The report has since been disclosed publicly with full technical detail (redacted only where necessary to protect implementation specifics) on SavannaHub, where the community can see exactly how it was found, confirmed, and fixed.

Why this matters

This is the whole point of running a public Vulnerability Disclosure Program against your own platform, not just the products companies list on it. HackerSavanna asks researchers to hold every program on the platform to a high standard, and that has to start with holding ourselves to the same one. Sylvester's report did precisely that, and did it well: a clean reproduction, a clear technical writeup, and a real, demonstrable impact rather than a theoretical one.

Congratulations to Sylvester Jusu on both the fix and the well-earned scholarship. If AfricaHackon Academy Cohort 7 is anything like the researchers it tends to produce, Cohort 7 is going to be a strong one.

Read the full disclosed report on SavannaHub.