How I Found a Critical Cloudflare Turnstile Bypass – And Got Denied a Bounty

Cloudflare Turnstile stores a token in your browser. I found you can copy it from one browser, paste it into another, and skip the CAPTCHA completely.

I tested it on their own demo site. Worked perfectly.

I reported it. Gave them the code proof. Showed them how to do it.

They said "we see it works." Then they said "out of scope" and locked the report.

They're fixing it now. Using my work. I get nothing.

That's it. That's the story.

How to do it:

Go to demo.turnstile.workers.dev

Solve the CAPTCHA

Open DevTools → Local Storage

Copy _cftscs_0x4AAAAAAADnPIDROrmt1Wwj

Open incognito

Paste it before page loads

Refresh – no CAPTCHA

From their own code:

javascript

localStorage.setItem(_cftscs_${fe}, n.scs);

javascript

ce = localStorage.getItem(scsKey);

// No IP check. No browser check.

No validation. Just works anywhere.

Their excuse:

"Turnstile is out of scope."

The policy says "automated bypasses via script" are excluded.

I said "I did it manually, no script."

They said "we know the wording is vague, we'll fix it." Then locked the report.

They took my research. They're fixing it. I got nothing.

That's how bug bounties work sometimes.

Companies want your work. They just don't want to pay for it.