3 ms·

I hate that Zendesk refused to pay out for this bug. The author made a good faith effort to report it. The author also tried to escalate it. After they decided

I hate that Zendesk refused to pay out for this bug. The author made a good faith effort to report it. The author also tried to escalate it. After they decided not to work on it, they later came back and asked him for more information and treat it like a bug... Author should have gotten a reward. Did everything right if Zendesk claims it's not a in scope bug.

paulpauper 2y ago
That is how it works. Do nothing so that the researcher breaks the rules innadvetedly as an excuse to not pay, and then fix the problem.
- m11a 2y ago
  Doubtful. It's probably just incompetence, rather than malice. The incident almost certainly cost Zendesk more in (according to the gist) lost contracts and reputational damage than it would've cost to pay the security researcher a bounty.
  - paulpauper 2y ago
    Or just fix the problem and not pay the bounty. Why pay at all if you can find a way not to?
    - m11a 2y ago
      Risk of bad rep when the researcher reports to HN or makes some noise. Then future security researchers don’t try find issues on your platform, and it’s more insecure as a result. For a sensible large company, it’s not worth being stingy over (relative) pennies. They waste money like it’s water. They might as well spend where it matters. Bug bounties won’t even show on their bottom line, but cleanup for an exploited issue will.