Hmm, they don't look that bad - https://hackerone.com/paypal https://hackerone.com/paypal Here's an example of something that got paid out by paypal - https://

Hmm, they don't look that bad - https://hackerone.com/paypal https://hackerone.com/paypal Here's an example of something that got paid out by paypal - https://hackerone.com/reports/739737 https://hackerone.com/reports/739737 (15K) Good writeup - https://medium.com/@alex.birsan/the-bug-that-exposed-your-paypal-password-539fc2896da9 https://medium.com/@alex.birsan/the-bug-that-exposed-your-pa... Interesting history with paypal - https://hackerone.com/alexbirsan https://hackerone.com/alexbirsan Here's how duplicate reports are dealt with - https://docs.hackerone.com/programs/duplicate-reports.html https://docs.hackerone.com/programs/duplicate-reports.html I am curious if paypal provided the OP with original reports. They don't say. I wonder how much the OP is not saying here, versus how much they understand the platform they are working on. This statement makes me very curious: "Other criticisms have pointed out that Security Analysts can first delay the reported vulnerability, report it themselves on a different bug bounty platform, collect the bounty (without disclosing it of course), and then closing the reported issue as Not Applicable, or perhaps Duplicate." How can you do that if you're providing the original report? Also, the guy is just wrong. You GAIN rep points for duplicates, unless you did something dumb and really amateur like not searching first for already publicly disclosed issues. https://docs.hackerone.com/hackers/reputation.html#effects-of-report-state-on-reputation https://docs.hackerone.com/hackers/reputation.html#effects-o...