3 ms·
Unfortunately this isn't all black-and-white. There are some bug bounty where the company is very eager not to pay any bounty, aggressively marking vulnerabilit
by KolmogorovComp 5mo ago
Unfortunately this isn't all black-and-white. There are some bug bounty where the company is very eager not to pay any bounty, aggressively marking vulnerabilities as out-of-scope or working-as-intended.
In those case you already lose time, but in the future you would also lose money.
Unfortunately you don't know how a company will react before submitting, especially if it's a small one.
- malfist 5mo agoIt already doesn't stand on face value. These people are spending money to open PRs via their token costs
- therepanic 5mo agoNo, not them, but those who provide subsidies to AI labs, which is why such people spend almost nothing
- Kwpolska 5mo agoI think it would be fair to distinguish "reasonable report, but not actually a vulnerability" (where you get the submission fee back) and "slop" (where you don’t).