4 ms·

e: I just noticed, this post was from 2 years ago. It should have (2021) in the header. --- I help run a bug bounty program, we get a lot of submissions. Way

e: I just noticed, this post was from 2 years ago. It should have (2021) in the header. --- I help run a bug bounty program, we get a lot of submissions. Way too many of them are zero or low effort. The SPF meme one definitely resonates with me, we get it a whole lot. Occasionally we will get someone who submits a half dozen variations of the same zero/low-effort report. When we turn around and deny them all (because there's no actual exploitable issue). There's a good chance they will then spend the next week replying to our emails asking for money because they put a lot of effort into it, and/or disputing our evaluation. It's frustrating dealing with that, and I can certainly sympathise with wanting to reply to someone who's begging you for money with a "no, go away". Perhaps Troy just needed to blow off some steam, but I think he'd be better having a saved reply in his email saying he doesn't pay bug bounties for personal projects/sites, and just send that. I think it'd go over better than having what seems to be an overly aggressive post.

billy99k 3y ago
Here is another perspective: I have been making money through bug bounties for the past 5 years (I'm a researcher on the major bug bounty sites and multiple private ones). More times than I can count, I have found major, non-low effort bugs, and the company will spend time deflecting, and I just won't end up getting paid. Luckily, this is less than 10% of the valid bugs I've found. I've learned to just move on after a certain point. This behavior from these companies nearly made me quit 2 years ago. I was so frustrated that I completely stopped for 6 months. I found 50 bugs in a week for one major company and they spend 2 months trying to tell me that they don't own the site anymore, and weren't going to pay me. It was in scope at the time I found the bugs. These weren't just minor bugs either. It allowed me to break into all private rooms on the service in multiple ways, get access to back-end network settings, and even takeover accounts. I pushed back and they were in violation of their SLA. I got a nice payout a few weeks later.
- billy99k 3y ago
  To add to this (because I can no longer edit my post). An excuse I saw just last week is that although I found vulnerabilities, the company doesn't believe it's a security issue and have no interest in fixing it, so the reports will be closed as informative. Keep in mind the bugs I found allows a lower-privileged group to not only access, but updated privileged information and other sections in the account with no user interaction. Definitely a security issue (multiple, in fact). This is why security issues never get fixed and people like me stop looking. I suspect they will fix it and are again trying to find ways not to pay me.

billy99k 3y ago

Here is another perspective: I have been making money through bug bounties for the past 5 years (I'm a researcher on the major bug bounty sites and multiple private ones). More times than I can count, I have found major, non-low effort bugs, and the company will spend time deflecting, and I just won't end up getting paid. Luckily, this is less than 10% of the valid bugs I've found. I've learned to just move on after a certain point. This behavior from these companies nearly made me quit 2 years ago. I was so frustrated that I completely stopped for 6 months. I found 50 bugs in a week for one major company and they spend 2 months trying to tell me that they don't own the site anymore, and weren't going to pay me. It was in scope at the time I found the bugs. These weren't just minor bugs either. It allowed me to break into all private rooms on the service in multiple ways, get access to back-end network settings, and even takeover accounts. I pushed back and they were in violation of their SLA. I got a nice payout a few weeks later.

billy99k 3y ago
To add to this (because I can no longer edit my post). An excuse I saw just last week is that although I found vulnerabilities, the company doesn't believe it's a security issue and have no interest in fixing it, so the reports will be closed as informative. Keep in mind the bugs I found allows a lower-privileged group to not only access, but updated privileged information and other sections in the account with no user interaction. Definitely a security issue (multiple, in fact). This is why security issues never get fixed and people like me stop looking. I suspect they will fix it and are again trying to find ways not to pay me.