3 ms·
That title is also completely misleading because the author did not in fact get paid. 50k corresponds to the money they made with unrelated bug bounties. I wi
by gouggoug 2y ago
That title is also completely misleading because the author did not in fact get paid.
50k corresponds to the money they made with unrelated bug bounties.
I wish they would fix the title so that it properly calls out zendesk refused to pay for a serious bug.
- masfuerte 2y agoI understood it to mean that he received $50K from enterprises using Zendesk who were vulnerable to this bug, but it's not entirely clear.
- cjbprime 2y ago"Unrelated" doesn't sound right. Zendesk refused to pay for the vulnerability, so the researcher used it against downstream customers of Zendesk, who did pay the researcher for the impact of that Zendesk vulnerability against their own company.
- gouggoug 2y agoIndeed - I misspoke.