4 ms·
Depends on if you want to get paid. Many organizations will not pay bug bounties if you disclose before they fix or without their consent. Project Zero probabl
by manquer 5y ago
Depends on if you want to get paid. Many organizations will not pay bug bounties if you disclose before they fix or without their consent.
Project Zero probably doesn't care or doesn't even accept the bounties
- jsnell 5y agoThe post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ it seems like the requirement for a bounty is not for "don't disclose before fix is released", but "don't disclose without reasonable advance notice". So I just don't see the inconsistency here. Project Zero gives a disclosure deadline. The reporter here chose not to give one. When they said they wanted to disclose, there was no stalling for extra time. Just what is the expectation here?