3 ms·

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this

by tux3 2y ago

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears to my eyes.

bdowling 2y ago
[flagged]
- Retr0id 2y ago
  That's not what happened at all, and the article you link doesn't say that.
- gcbirzan 2y ago
  Actually, they posted that a vulnerability existed, https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937: > someone from @a16z get in touch, now. its bad. security related
  - bdowling 2y ago
    What's the relevant difference?
    - gcbirzan 2y ago
      I don't remember what your post originally said, but posting about a vulnerability is not the same as disclosing the vulnerability. Especially when you're asking for a contact. The difference, in case you really want to know is that one actually tells everyone what the issue is, another tells everyone that there is an issue.
  - londons_explore 2y ago
    So they didn't disclose the bug publically... They simply disclosed that there was a bug. That isn't IMO disclosure. Nearly anything has a bug if you look hard enough.
Salgat 2y ago
Just a heads up, another comment was posted here that shows right on their website's contact page a list of e-mails for contacting them.
hpeter 2y ago
It only gets worse when the company that published their environment variables sues the security researchers for finding it. It happens.
newyankee 2y ago
Any legal basis to challenge this practice ? If a company claims that they pay bug bounties but use flimsy reasons like this to chicken out of seemingly genuine cases like these
- pixl97 2y ago
  I'm guessing no, and even if their was they could make the litigation costs very high. The sad thing here is what has to happen is the data needs sold off to blackhats to the point that entire countries get pissed and start putting near draconian level regulations and fines against companies like this to get them to stop this insecure bullshit.
deleted 2y ago
[deleted]

by tux3 2y ago

bdowling 2y ago

[flagged]

Retr0id 2y ago
That's not what happened at all, and the article you link doesn't say that.
gcbirzan 2y ago
Actually, they posted that a vulnerability existed, https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937: > someone from @a16z get in touch, now. its bad. security related
- bdowling 2y ago
  What's the relevant difference?
  - gcbirzan 2y ago
    I don't remember what your post originally said, but posting about a vulnerability is not the same as disclosing the vulnerability. Especially when you're asking for a contact. The difference, in case you really want to know is that one actually tells everyone what the issue is, another tells everyone that there is an issue.
- londons_explore 2y ago
  So they didn't disclose the bug publically... They simply disclosed that there was a bug. That isn't IMO disclosure. Nearly anything has a bug if you look hard enough.

Salgat 2y ago

Just a heads up, another comment was posted here that shows right on their website's contact page a list of e-mails for contacting them.

hpeter 2y ago

It only gets worse when the company that published their environment variables sues the security researchers for finding it. It happens.

newyankee 2y ago

Any legal basis to challenge this practice ? If a company claims that they pay bug bounties but use flimsy reasons like this to chicken out of seemingly genuine cases like these

pixl97 2y ago
I'm guessing no, and even if their was they could make the litigation costs very high. The sad thing here is what has to happen is the data needs sold off to blackhats to the point that entire countries get pissed and start putting near draconian level regulations and fines against companies like this to get them to stop this insecure bullshit.

deleted 2y ago

[deleted]