3 ms·

Sounds like a full time job vs. a gig.

• notatoad 5y ago
  yeah, these are all features of working on the development team of a project. involving every developer who wants to work on a bounty at that level would be an insane amount of management overhead. It makes sense if you're vetting people beforehand to make sure that giving them this level of access and communication is worth the effort, but that's what a job interview is.
  • deckar01 5y ago
    Not work on the bug, just be kept in the loop like the initial reporter. Putting in the same effort as the first reporter should earn you the same trust that is afforded to the first reporter.
    • ehsankia 5y ago
      If you're not going to win a prize, why would you need to be kept in the loop about an internal vulnerability that is being worked on? As for getting a prize, it goes back to the dupe issue which is the source of a lot of abuse. There's no way to prove you also worked on it or if you just got the info from your friend and want to double your winnings.