⚠️ Bug Bounty Tip: IDN Homograph → Account Collision

Don’t only test Unicode domains. Test Unicode in email/username fields too.

Try lookalike characters such as:

a → á / other Unicode variants

The interesting case is when:

Database: treats the values as equal
Application: identifies the victim account
SMTP: treats them as different addresses

Example:

victim@gmail.com
victim@gmáil.com

If the application finds the victim's account but sends the password-reset email to the attacker-controlled Unicode address, you may have an account-collision / account-takeover vulnerability.

📣**Test normalization at every stage:**
Input → Validation → Database → Token generation → Email delivery

#BugBounty #IDNHomograph #Punycode #WebSecurity