The beg bounty hunters make it a giant PITA to report genuine security issues. Even bigger companies end up going through platforms like HackerOne instead of pr

The beg bounty hunters make it a giant PITA to report genuine security issues. Even bigger companies end up going through platforms like HackerOne instead of providing a direct security contact, and you end up having to spend time proving/explaining to triagers that you have found an actual issue. (The reason why I refuse to use HackerOne is that they require you to agree to their arbitrary terms putting unreasonable restrictions on your ability to publish your research.) Doubly annoying when you find a minor issue where you simply don't know whether the company cares about it [1]: Do you report it and risk ending up being flagged as a beg bounty hunter, or do you skip reporting it, potentially leaving an issue open that the company may be interested in fixing? [1] Example: a site that requires TOTP both on login and sensitive actions but allows you to reuse the same TOTP for both if you're quick.