5 ms·

If this is a legitimate issue, you should have first tried to contact NordVPN through their official bug bounty program [1] with steps to reproduce and exploit'

If this is a legitimate issue, you should have first tried to contact NordVPN through their official bug bounty program [1] with steps to reproduce and exploit's consequences, given them adequate time to fix it, and then gone public with the vulnerability. (As long as your reward terms allowed you to) They're probably not mopping the issue under the carpet, but rather reddit is not their bug reporting platform. Though the page does say account takeover is out of scope, so I'm unsure what the program is even for. [1] https://hackerone.com/nordsecurity https://hackerone.com/nordsecurity

RL_Quine 5y ago
At this point I’d disagree; “bug bounty” programs are designed to frustrate reporters, cover up issues, and serve neither the reporter or users of a service. Guilting people fully disclosing isn’t really doing much to improve the situation for anybody.
rileymat2 5y ago
The public has no obligation to do free QA for a company. If they are getting people going public and not through the bug bounty program, that is on them for not making the stakes high enough.