4 ms·
The bug bounties are usually pretty clear that you aren't allowed to make changes in the production systems. Here they made many changes - including changing th
by azeemba 3y ago
The bug bounties are usually pretty clear that you aren't allowed to make changes in the production systems. Here they made many changes - including changing the name of a release.
The bug bounties also prefer seeing a working attack instead of theoretical reports. So not sure how they could have tested their attack in this situation without making actual changes.
- richbell 3y agoIt depends. Sometimes companies only permit testing in specific test domains, other times they permit it as long as your activity is clearly identifiable (e.g., including a custom header in all request). It does seem like walking a precarious tight rope.