I’m on the verge of giving up reporting security issues because companies don’t really seem to care. They’ll drag you through the weeds to sign up for their bou

I’m on the verge of giving up reporting security issues because companies don’t really seem to care. They’ll drag you through the weeds to sign up for their bounty program, make you fill a bunch of e-paperwork, then close your report as WONTFIX with an almost canned response without really considering the impact. Ok, so you say it’s expected behaviour, but does that mean it’s correct behaviour? I understand that it must be exhausting for security teams receiving hundreds of spam reports from “researchers” running crappy scanners, but there are also those of us who put time and effort into genuine reports. When they are closed after 5 mins without even a thanks, I just think I won’t bother next time. I think we would be in a much better security position globally if white hats were compensated well and protected by law.