3 ms·

> 9th April – Heard from the Zoom team that this was mitigated. > 16th April – Heard they were working on updated bug bounty program. > 15th June – Requested

by Naac 6y ago

> 9th April – Heard from the Zoom team that this was mitigated. > 16th April – Heard they were working on updated bug bounty program. > 15th June – Requested update on BB program. No reply. > 8th July – Asked again if I could submit this for bounty. No reply. > 29th July – Disclosure. That's disappointing that Zoom never got back to you regarding the bounty.

tito 6y ago
Gut check here on Zoom customer service. Has anyone heard from them in the last 2 months? I've been on a pro plan and 10-seat plan and had 2 issues about events sent to their customer service starting June 3rd. Have not heard back anything besides regular "we're moving slow because of COVID 19" template updates". They used to be responsive, even had a "chat" feature but now that's disabled.
- mystcb 6y ago
  I am going to raise my hands and say I have heard from them. I logged a support request on March 24th (the day the UK went into lockdown, so I was already expecting a delay). I finally got a response back on July 20th. It is a shame they are slow, as they have been really responsive in the past. Hope that helps set a bit of a benchmark!
  - tito 6y ago
    Appreciate it! 2 months, sounds like I may get a response soon then.
  - tito 6y ago
    Yep they just replied. 2 month backlog on support requests for paid accounts, ouch.
cs02rm0 6y ago
Bug bounties seem to be a complete wild west. I've reached the point of assuming the odds are stacked so heavily that, from a purely financial perspective, it's not worth the investment just to report an issue let alone find it.
- blahbhthrow3748 6y ago
  You have to work with good companies that have a track record and clear policies. My last employer was pretty generous and timely AFAICT, including sometimes paying for stuff that was useful but clearly out of scope for the program.
TwoBit 6y ago
Well that's just going to result in the next hacker going straight to public.
wlj 6y ago
There’s an update regarding this at the bottom of the post: > Update edit: A few people have asked me or remarked about the lack of bounty. To be clear, I never actually submitted this bug via their bounty program (but was invited to do so), as was holding out for their new program (see post), and fell down the cracks a bit. Zoom didn’t decide against awarding a bounty – I never submitted for one, and disclosed here instead.
- unityByFreedom 6y ago
  He was being courteous trying to follow an update to the bounty program and Zoom ghosted him, > 16th April – Heard they were working on updated bug bounty program. > 15th June – Requested update on BB program. No reply > 8th July – Asked again if I could submit this for bounty. No reply. (Point of clarity here – the bug is fixed, and they have new issues to deal with so this isn’t exactly a priority for them. I could have chosen to file the bug for a bounty at the time, but didn’t, and wasn’t promised anything if I waited). If Zoom were serious about their BB program they would have encouraged him to submit it for a bug bounty.

by Naac 6y ago

tito 6y ago

Gut check here on Zoom customer service. Has anyone heard from them in the last 2 months? I've been on a pro plan and 10-seat plan and had 2 issues about events sent to their customer service starting June 3rd. Have not heard back anything besides regular "we're moving slow because of COVID 19" template updates". They used to be responsive, even had a "chat" feature but now that's disabled.

mystcb 6y ago
I am going to raise my hands and say I have heard from them. I logged a support request on March 24th (the day the UK went into lockdown, so I was already expecting a delay). I finally got a response back on July 20th. It is a shame they are slow, as they have been really responsive in the past. Hope that helps set a bit of a benchmark!
- tito 6y ago
  Appreciate it! 2 months, sounds like I may get a response soon then.
- tito 6y ago
  Yep they just replied. 2 month backlog on support requests for paid accounts, ouch.

cs02rm0 6y ago

Bug bounties seem to be a complete wild west. I've reached the point of assuming the odds are stacked so heavily that, from a purely financial perspective, it's not worth the investment just to report an issue let alone find it.

blahbhthrow3748 6y ago
You have to work with good companies that have a track record and clear policies. My last employer was pretty generous and timely AFAICT, including sometimes paying for stuff that was useful but clearly out of scope for the program.

TwoBit 6y ago

Well that's just going to result in the next hacker going straight to public.

wlj 6y ago

There’s an update regarding this at the bottom of the post: > Update edit: A few people have asked me or remarked about the lack of bounty. To be clear, I never actually submitted this bug via their bounty program (but was invited to do so), as was holding out for their new program (see post), and fell down the cracks a bit. Zoom didn’t decide against awarding a bounty – I never submitted for one, and disclosed here instead.

unityByFreedom 6y ago
He was being courteous trying to follow an update to the bounty program and Zoom ghosted him, > 16th April – Heard they were working on updated bug bounty program. > 15th June – Requested update on BB program. No reply > 8th July – Asked again if I could submit this for bounty. No reply. (Point of clarity here – the bug is fixed, and they have new issues to deal with so this isn’t exactly a priority for them. I could have chosen to file the bug for a bounty at the time, but didn’t, and wasn’t promised anything if I waited). If Zoom were serious about their BB program they would have encouraged him to submit it for a bug bounty.