4 ms·
The unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it. It's a bit ridiculous that
by prophesi 8y ago
The unprofessional part is disclosing the issue publicly 5 months after the company estimated it would take them 6 months to fix it.
It's a bit ridiculous that such a high-risk bug could be given so much time for it to be fixed, but that's how HackerOne's guidelines go. https://www.hackerone.com/disclosure-guidelines https://www.hackerone.com/disclosure-guidelines
(I'm personally a fan of a tiered system wherein high-risk bugs have a hard deadline of 3 months or less before public disclosure, and medium/low risk bugs a much longer deadline)