4 ms·
>It's a bug bounty, not a "only if we have time to fix it" bounty It's only a bug if it's not intended
by coldtea 2y ago
>It's a bug bounty, not a "only if we have time to fix it" bounty
It's only a bug if it's not intended
- ethbr1 2y agoDo some companies intend for their platform to feature remote code execution?
- jen20 2y agoRemote code execution is literally a feature of GitHub…
- ethbr1 2y agoSandboxed code execution is a bit different than RCE.
- coldtea 2y agoSome might very well do. E.g. a company with a service for training hackers and security researchers. In this case the question is moot, as this doesn't involve remote code execution.
- ethbr1 2y agoMake a general point, get a general answer. If the criteria for bug is "not intended", and that's solely judged by the company, then broken auth et al. suddenly become part of their product design. If it quacks like a bug, it's a bug.
- bmitc 2y agoI think a lot of developers and companies interpret "that's the way the code or process works" as intentional behavior, which is not always the case.