5 ms·
It's not unreasonable as there was no contract or established program. You did the work without any defined outcome guaranteed. I would take this disclosure (d
by ganoushoreilly 5y ago
It's not unreasonable as there was no contract or established program. You did the work without any defined outcome guaranteed.
I would take this disclosure (depending on what it is and how it impacts) and use it to market yourself and further your industry credibility.
If it's a big impact I think some sort of bounty is great, but you can use it as a pivot point to encourage them to build a program.
- jcuenod 5y agoYes, there's no contract and I didn't start out expecting to come across a vulnerability so obviously there was no outcome expectation on my part. I think I'm feeling frustrated that industry credibility is not meaningful to me because this is not my industry and the expectation of pro bono responsible disclosure means that they take advantage of my expertise when (1) I never offered it and (2) they pay developers to do this kind of work all the time. I think you're helping me get at an underlying question I have: is it fair to say, "if you're running a SaaS, you should have a bug bounty program?"