4 ms·

This and the pre-triage are the only reasons we even use a bug bounty platform. If paying out bounties was easy I would do it all via email; but as you said it

This and the pre-triage are the only reasons we even use a bug bounty platform. If paying out bounties was easy I would do it all via email; but as you said it’s almost impossible to do (unless you are maybe bigcorp and have a team just for that)

maccard 2mo ago
I worked at a big corp and we paid out randoms for a program (not bug bounty). It was an absolute minefield, people would lie to us about where they were located only for us to find out they’re in <insert sanctioned country here> and then legal tells us we have to pay them but we’re not allowed to at the same time. Outsourcing all that mess is a great use of money.
- icantevenhold 2mo ago
  Yea we also handled it ourselves the first couple years but it was so painful. Literally the same thing you described happened - as well spending weeks+ how we need to file it as tax when we pay bounty to someone in Pakistan etc.
  - weird-eye-issue 2mo ago
    Are you in the US? You simply collect a W8 from them that you keep on file and then the payment would be counted as an expense on taxes. We do payout to hundreds o f affiliates every year and this is how we handle it, it's really not complicated. The actual payments are done via Wise batch payments which just requires their email address.
    - bhg45g34 2mo ago
      [dead]
kay_o 2mo ago
My largest problem with H1 is how braindead scripted/AI their triage is. - Starting scenario: no way to contact a company outside of H1 (or some other managed programme) - The company is compromised, their customer support has no idea what this means, they have no security.txt or any other security contact - I have explicitly told H1 to just forward it with no bounty, I don't want a bounty, only remediation, I do not care about a bounty or any reward - H1 closes as "not eligible" and tells me to not submit stuff I can't prove it's my compromise by putting my username on it - Corporate server is still compromised and being used as a proxy to brute force my services
- brumbelow 2mo ago
  [flagged]
- true_religion 2mo ago
  If a company's server is attacking yours, I'd go to legal@company.com before I go to H1.

maccard 2mo ago

I worked at a big corp and we paid out randoms for a program (not bug bounty). It was an absolute minefield, people would lie to us about where they were located only for us to find out they’re in <insert sanctioned country here> and then legal tells us we have to pay them but we’re not allowed to at the same time. Outsourcing all that mess is a great use of money.

icantevenhold 2mo ago
Yea we also handled it ourselves the first couple years but it was so painful. Literally the same thing you described happened - as well spending weeks+ how we need to file it as tax when we pay bounty to someone in Pakistan etc.
- weird-eye-issue 2mo ago
  Are you in the US? You simply collect a W8 from them that you keep on file and then the payment would be counted as an expense on taxes. We do payout to hundreds o f affiliates every year and this is how we handle it, it's really not complicated. The actual payments are done via Wise batch payments which just requires their email address.
  - bhg45g34 2mo ago
    [dead]

kay_o 2mo ago

My largest problem with H1 is how braindead scripted/AI their triage is. - Starting scenario: no way to contact a company outside of H1 (or some other managed programme) - The company is compromised, their customer support has no idea what this means, they have no security.txt or any other security contact - I have explicitly told H1 to just forward it with no bounty, I don't want a bounty, only remediation, I do not care about a bounty or any reward - H1 closes as "not eligible" and tells me to not submit stuff I can't prove it's my compromise by putting my username on it - Corporate server is still compromised and being used as a proxy to brute force my services

brumbelow 2mo ago
[flagged]
true_religion 2mo ago
If a company's server is attacking yours, I'd go to legal@company.com before I go to H1.