How I chained three public V8 bugs against Google’s v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.