3 ms·

There's nothing on the VRP which effectively covers business logic vulnerabilities. Realistically, this would be precisely why such a category would be needed.

There's nothing on the VRP which effectively covers business logic vulnerabilities. Realistically, this would be precisely why such a category would be needed. Closest I can fit it into within their existing scheme is: > Logic flaw bugs leaking or bypassing significant security controls -- Other highly sensitive applications [2] -- Vulnerabilities giving direct access to Google servers But that's a stretch, and the payout is still atrociously low for the value you could've squeezed out of it, potentially legitimately (millions). TomAnthony, in your position, I'd keep making a stink here and possibly even see what other quirks you might find in PageRank and just pocket them for now. I've reached out to some old members of the VRP team to see if they can shed any light on whether the VRP can be tuned a bit in response to this, but you certainly should've gotten more.

TomAnthony 9y ago
Thanks for your insights. I actually considered the same spot in the matrix as best fit, but also identified this sort of 'business logic' isn't a good fit anywhere in the matrix. I'm British so not good at kicking up a stink! However, it is Google's VRP, and they are under no obligation to give anyone anything, so am not sure I have grounds to do so anyway. As I've said elsewhere, it is just hugely de-motivating and a disincentive (for both me and others) for similar research in future. I think it would be a great addition to the VRP for them to include things affecting the core algo (their main product), but imagine it would be tricky to do without also getting a huge number of very tenuous reports.