4 ms·

There's a pretty relevant blog that recently came up on this: https://soatok.blog/2022/06/14/when-soatok-used-bugcrowd/ https://soatok.blog/2022/06/14/when-soa

• BonoboIO 4y ago
  Just wow ... what a trainwreck.
• tgsovlerkhgsel 4y ago
  The PoC requirement seems to be there to help the triage team filter out the many garbage reports they get. Having seen a glimpse of what you get out of a bug bounty program (lots and lots of people with no clue submitting bogus reports) I understand why companies are doing that, but especially for a commercial company, their triage burden is not my problem. I'm doing them a massive favor by reporting it, and as mentioned above I'm not getting paid adequately for it... so either they do the triage properly (yes, that's a lot of work), or they pay me to spend time to give them a clearer proof... or they don't get the vulnerability reported/responsibly disclosed. Ironically, if you went through one of the platforms initially and they responded like that, you can't just go full disclosure anymore without violating the platform ToS, just like this post showed. The absolute minimum that such platforms should do would be report closed = NDA lifted, but since they're more dependent on their paying customers than the researchers, they won't do that.