3 ms·

Why not offer only a dollar then?

• tptacek 7y ago
  You joke, but lots of places that don't offer cash bounties still get good bounty submissions. Google offers bounties because they can, and to attract more submissions. Like I said below: for this kind of work, $6k is a strong bounty. Not a lot of places will pay you thousands of dollars for a URL whitelist bypass bug.
  • crankylinuxuser 7y ago
    Depends. Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not. Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.
    • tptacek 7y ago
      No. People who find drive-by RCE vulnerabilities are in a market with "grayweb exploit dealers". People who find URL whitelist validation bugs are not. The distinction is important and directly reflected in the bounty rates for the different kinds of bugs. And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.