4 ms·
No. A bug that can be trivially found is higher likelihood of being exploited, and thus higher impact.
by cwkoss 4y ago
No. A bug that can be trivially found is higher likelihood of being exploited, and thus higher impact.
- ZiiS 4y agoHigher impact; but if it is just luck you are the first of many to find it and did not invest a lot of work in its discovery is reasonable to pay less. Under "Closed as dup" system the probability is you get nothing for reporting trivially found bugs. Whilst you are still providing valuable information (that lots of people can find it).
- bawolff 4y agoWell i see where you are coming from, the point of bug bounties is to reduce risk to the company not neccesarily to reward effort of the researcher. There is a sense that a bug where you have to be NSA level of skill to find is less likely to be exploitted than a bug that every script-kiddie is stumbling upon.