4 ms·
From my experience with bug bounties, if it's not on the OWASP TOP10, they'll kick, stamp, scream and fight -- even if you say "I don't want the bounty, I just
by philpem 7y ago
From my experience with bug bounties, if it's not on the OWASP TOP10, they'll kick, stamp, scream and fight -- even if you say "I don't want the bounty, I just want this bug fixed".
(backstory: found a bug in Twitter which disclosed DMs. Reported it, Twitter engineer had a raging tantrum on Hackerone, H1 (I assume) mistook his messages for mine and banned me from the site. Found out a mutual was a Twitter engineer, sent him the POC. A few days later, fixed)
- dannyw 7y agoI refuse to use H1 because of how hostile they are to security researchers.
- Aeolun 7y agoThat’s so counterproductive it would be funny if it wasn’t so sad.
- IggleSniggle 7y agoPlease don’t abbreviate as H1. It messes up my pronunciation of the Hackerone program. Hackerone rhymes with macaroni.
- zifnab06 7y agoMuch like CoreOS rhymes with Oreos.