3 ms·
> the severity of the exploit, not the potential damage you could do with it Isn't severity measured in terms of potential damage?
by MaxBarraclough 6y ago
> the severity of the exploit, not the potential damage you could do with it
Isn't severity measured in terms of potential damage?
- WalterGR 6y agoYes. https://www.facebook.com/BugBounty/posts/approaching-the-10th-anniversary-of-our-bug-bounty-programby-dan-gurfinkel-secur/4087540111260184/ https://www.facebook.com/BugBounty/posts/approaching-the-10t... CDN bug report... Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our CDN... a very sophisticated attacker could have escalated to remote code execution. As we always do, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty — $80,000.