This has been this way for several years now. I have notes on a Google attack I discovered ~2 years ago that includes an open redirect as a critical part. It a

This has been this way for several years now. I have notes on a Google attack I discovered ~2 years ago that includes an open redirect as a critical part. It allows running arbitrary JS on authenticated users on the click of a link. However, there is one small part of the attack (one character!) which prevents it working so I've never reported it. Interesting that there is such a debate here, as I thought open redirects were generally accepted as out of scope for most bug bounties.