When we started a vulnerability disclosure program for Mastodon (funded by the EU through some start-up provider they had a contract with) the first rule they h

When we started a vulnerability disclosure program for Mastodon (funded by the EU through some start-up provider they had a contract with) the first rule they heavily encouraged was that we consider all DOS vulnerabilities out of scope. There are just so many easy ways to DOS a complex system by taking legitimate-but-costly actions that worrying about the small % of illegitimate actions that could also DOS a system just isn't worth it for most projects. (This is not to say that we wouldn't consider the very rare case where a trivial input could lock up the system for hours due to us missing a timeout or something important, or that we wouldn't consider e.g. rate limiting bypasses as vulnerabilities. I'm not speaking officially or completely here, we try to apply a lot of nuance and common sense to the way we review vulnerabilities when disclosed)