5 ms·

Only a $6000 reward for being able to intercept someone's email?!

• happyopossum 4y ago
  Likely impacted by the fact that this was in a private beta and not a publicly available product. Betas are “supposed to” have bugs.
  • r1ch 4y ago
    A well-run bug bounty should encourage early reporting of issues. Should he have waited until public release so the impact was bigger?
    • rsstack 4y ago
      It's a moot point because this hasn't happened. Cloudflare didn't lower the payout because it was in beta.
      • r1ch 4y ago
        Yeah I didn't realize CF's payouts were so low.
  • Bytewave81 4y ago
    A "private" beta enforced solely by a clientside check, notably.
    • rsstack 4y ago
      Sure, but the client-side check completely limits the exposure Cloudflare have because big enterprise corporates don't get themselves into a private beta by playing with client-side checks. Only a few companies were using this feature at the time.
• jtokoph 4y ago
  Seems to be double their max payout of $3,000: https://hackerone.com/cloudflare?type=team#user-content-rewards https://hackerone.com/cloudflare?type=team#user-content-rewa... It was also comprised of two separate $3,000 rewards. Maybe they treated it as two vulnerabilities?
  • albertpedersen 4y ago
    In this case the second $3000 bounty was due to a 2x promotion at the time. The guideline for a critical is $3000, but Cloudflare does occasionally award bonuses for severe vulnerabilities (e.g. https://hackerone.com/reports/1478633 https://hackerone.com/reports/1478633).
  • riedel 4y ago
    6k seems to be a really low payout given the potential impact (particularly with respect to personal data), the work needed to discover such vulnerabilities, the revenue of cloudflare and the potential money that could be made by a blackhead. Or am I naive?