3 ms·
It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
by griffinmb 8y ago
It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.
- prophesi 8y agoThe unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it. It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines https://www.hackerone.com/disclosure-guidelines (I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)