3 ms·
I have had replies on bug bounty reports in under 10 before. It can and does happen. Edit: To clarify, especially in cloud environments (which is most stuff th
by BeefWellington 4y ago
I have had replies on bug bounty reports in under 10 before. It can and does happen.
Edit: To clarify, especially in cloud environments (which is most stuff these days) it's really not hard for someone to verify something if it's well written.
- movedx 4y agoI might be a bit pessimistic here, but I'm betting that's not an experienced, trained individual that's responding to the ticket. It's like a level one techie who's basically just moving the ticket from one queue to another and potentially waking someone up if it looks scary enough. That's not really the same thing.
- BeefWellington 4y agoI'm talking actual confirmation of the issue and acceptance of scoring from someone clearly technical.
- bink 4y agoIt's certainly possible. I've handled a bunch of bug bounty programs and sometimes submissions come in at just the right time and attract just the right attention. It's not a reasonable expectation for the average submission.
- BeefWellington 4y agoIt depends on your targets, IME. Huge companies? Yep, you'll get a "thanks for telling us" from a bigger bug bounty program and then not hear anything for weeks to months. For small- and mid-sized companies that do bug bounties (of which there seem to be fewer and fewer these days as a percentage) you can definitely wind up submitting directly to the right people and get really quick response times.
- deleted 4y ago[deleted]