Yes. I was the lead security engineer at my previous job, and these messages were always marked as “Informative” and, eventually, “Duplicate”. The major bug bo

Yes. I was the lead security engineer at my previous job, and these messages were always marked as “Informative” and, eventually, “Duplicate”. The major bug bounty websites like Bugcrowd and HackerOne have rules about duplicate and non-actionable submissions, which usually hurt the researcher, for example, by decreasing their reputation points. After the first couple of submissions, I got curious, so I decided to open a separate category for these submissions where I asked every researcher to provide a proof of concept of the attack. Unsurprisingly, none of them were able to. Some of them closed their own submissions, and the others lost some reputation points due to Bugcrowd or HackerOne’s intervention. Somehow, we did not receive more submissions about DMARC, SPF, or DKIM after that, which was interesting, as if all the researchers were working together to spam as many bug bounty programs as possible with the same “vulnerability” to get easy money from unsuspected program managers.