2 ms·

Am I very naive expecting the payout to be significantly higher?

• ec109685 2y ago
  Interesting that the bounty amount went down due to how obscure the attack vector was.
• SXX 2y ago
  Unfortunately high payouts is just not how cyber security industry work. Instead of high payouts you get vanity and higher chance to get well-paid job.
  • immibis 2y ago
    You can get a high payout if you're also willing to risk your life. Companies are relying on researchers doing the ethical thing instead of the profitable thing.
• cesarb 2y ago
  To me, that payout felt quite high; it's bigger than the average monthly salary for a senior IT professional where I live. To put it another way, that bounty alone would be like being paid for several months of full-time employment.
  • deleted 2y ago
    [deleted]
• tgsovlerkhgsel 2y ago
  Yes. Bug bounties aren't that high. For an issue that does so little (leaking an identity vs. e.g. giving access to an account or remote code execution), I'd actually consider that a surprisingly high amount, and I would expect that many companies wouldn't consider this class of bug a bounty-worthy issue at all - "thanks for the report", maybe fix it maybe not, but no bounty.