A Thai university student has just received a thank‑you letter from NASA for reporting a security flaw. The story shows how responsible disclosure can turn a technical find into professional recognition.

Thanapon Butsricha, a first‑year cybersecurity student at Khon Kaen University, discovered a cross‑site scripting (XSS) vulnerability. Working under the online name “nullbyt3z,” he submitted the finding through NASA’s vulnerability disclosure policy.

NASA replied with a letter dated Nov. 5, signed by senior information security officer Kelvin Taylor. The agency’s policy states that researchers receive no monetary payment, only gratitude and a recognition letter when the report is validated and fixed.

Thanapon said the hardest part was locating the vulnerability and making sure his report was not a duplicate of an earlier submission. Assistant professor Phet Imtongkhum noted that the achievement demonstrates that the university’s students possess international‑level technical skills and professional ethics.

The case illustrates that ethical reporting of security flaws can earn real acknowledgment from a world‑renowned organization. It also shows that responsible disclosure is a valuable path for aspiring cybersecurity professionals.