Gandi security vulnerability: two factor authentication bypass (pietroalbini.org)

  They said they can't currently afford a bug bounty program, 

You're their hero of the week, at least -- they couldn't offer you free hosting or registration for a domain or three?

Very nice write-up!