As I found out when I first put something up for review on HackerOne, there is a whole cottage industry of people just running scanners and blindly reporting wh

As I found out when I first put something up for review on HackerOne, there is a whole cottage industry of people just running scanners and blindly reporting whatever comes out. They are doing this to get something on their resume and maybe receive a bounty, not to improve global software health. It’s basically spam, because all the effort is on the part of the receiver to figure out if these reports make any sense. (And of course you can pay H1 to do that for you.)