Bug Bounty, two years in

blog.twitter.com

45 points·amitku··10 comments

Open articleView on HN

my experience with bug bounties

Me: here is a bug

Them: it's a feature, not a bug [fixes feature]

Similar

This behavior compromises the privacy of few hundred million users and circumvents your policy.

It is not XSS/CSRF and it is by design, your ticket is closed.

At least they did not fix it last time I checked.

fulldisclosure exists for a reason.

Or in my case recently with trying to get HubSpot to support PRURLs:

Me: Here is a bug. Your implementation does X when the specification says that it should do Y. Here is the RFC and the relevant sections explaining how it should work [link].

Them: This isn't a bug. Reference to some other popular piece of unrelated software that also has a faulty URL implementation. Half-assed apology for creating an un-resolvable problem for you while implying that you're an idiot at the same time.

Side-note: Please, everyone stop writing your javascript URL validation with checks for "http(s)"

I never knew about PRURLS. I will do ask you suggest.

One possible response to "It's a feature not a bug" is, "oh in that case you won't mind if I disclose it immediately"...

If they mind it being disclosed, it's probably not a feature.

So they've paid out $300k in two years? That sounds appallingly low and surely unappealing for anyone bug hunting professionally.

Bug bounties are basically not designed to lure in security experts who live in a first-world country and who already have established a reputation.

It's crowdsourcing, and for-profit crowdsourcing is pretty much exploitative by definition.

Congratulations, you're one of today's lucky 10,000:

https://news.ycombinator.com/item?id=11249173

Reply on news.ycombinator.com