3 ms·
> Contains "critical" and "payment" -> straight to the bin. That sounds like an excellent way to accidentally filter out serious vulnerabilities. I'm glad you
by dns_snek 3y ago
> Contains "critical" and "payment" -> straight to the bin.
That sounds like an excellent way to accidentally filter out serious vulnerabilities. I'm glad you don't work for the vendor that received my urgent, critical (in all caps) unauthenticated remote code execution vulnerability report.
They were very grateful that I reached out and resolved it under 72h.
- dools 3y agoYep I have received a genuine report completely unsolicited before, paid a modest bounty and fixed the problem immediately, then took some precautions to ensure any potential data leaks were rendered innocuous. I was very glad to have received the info and I think folks such as yourself are doing valuable work.
- viraptor 3y agoDid you write "I found critical vulnerability on your website, how much is your bounty, can you send PayPal payment?" If it wasn't something close to that, then no, it wouldn't be filtered. If it wasn't obvious, the patterns are trivial, but not "check those two words" level of trivial. You need to apply common sense and adjust for your environment.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]