> They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling t

> They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?rtc=1 https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md