3 ms·
at $DAYJOB we get multiple beg bounties a week, it's a massive waste of everyone's time and it's literally never been a real issue.
by davidgerard 3y ago
at $DAYJOB we get multiple beg bounties a week, it's a massive waste of everyone's time and it's literally never been a real issue.
- whstl 3y agoAt my previous job it was about 10 per days after we started having an official process. I gather that people would just Google us. It was very easy to filter the bad reports, though. About 10 minutes of work per day, since most were repeated issues. We had a default "reply" email with information. The issue however was those people would get extremely angry when their security issue was deemed invalid, so we started just blocking recipients that would threat us or demand payment for invalid issues. Some would stalk me and other developers in LinkedIn and would demand immediate payment. Of course that only happened about 4 times. Another issue was caused when some invalid issues would get SO MANY REPORTS from automated scanners, that we would actually decide to change to prevent the reports. In some of those we actually paid and credited the first person, but then the other 30 would demand payment too and accuse us of lying. Huge shitshow.