second might be a bit generous. fourth maybe?

haha how did I miss the other ones

Well it just depends on how you count lol. The first one was XSS, but nobody was exploiting it, it was just a "hey you should fix it". The second was the auth bypass that I rather cheekily exploited as a PoC to post from the official twexit account, but nothing beyond that.

And the third was an SQL injection vuln which I reported privately around the same time as the second one (it was related to it), but I'm not sure I ever mentioned that one publicly.