3 ms·

> you'd be shocked how many people try to claim bug bounties from us because they "hacked" their own account using their own credentials. Wait ...what? Like, s

• gkoberger 4y ago
  Yup, but in a roundabout way. For example, they'll inspect traffic and nab a session cookie. Then they'll use that session cookie on another internal API request to change a setting, and claim they were able to modify a setting by reverse engineering things. They seem really scary at first, and then you dig into it and you're like "oh...".
• chrismarlow9 4y ago
  A few weeks ago I saw a vulnerability reported for an FTP server that claimed they could put a file on the remote server. With FTP! What madness! I wish I could find it but I cannot, still makes me chuckle.
  • gkoberger 4y ago
    Yeah, we get those too. We let people write JavaScript to build their sites (we're a site builder), and people will use that feature and add an alert and then claim it's XSS (on their own account).
• Beltalowda 4y ago
  I'd say that >90% of "security incidents" that I've seen reported are completely bogus. And we don't even have a bug bounty program. They will still beg for free stuff like t-shirts and other tiddletat. I think the majority is just ignorance rather than malice though.