> there is essentially zero upside to screwing over bounty hunters.
Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-2021-30560.
Well, I felt pretty screwed over after Google decided not to reward me for discovering CVE-2021-30560.
It's more helpful to analyze the situation from a game-theoretic standpoint. Bug bounty programs are a typical example of a cooperative game. If someone reports a security issue, they start the game by cooperating. Google can then choose to cooperate by paying a bounty or they can defect by refusing a reward. Like in the classical prisoner's dilemma, both parties can typically maximize their rewards by choosing to cooperate.
My case is a bit special. While I don't know the exact reasons why Google chose not to reward me, it's possible that they thought I would continue to cooperate even after they defected. But like most rational players, I chose to stop cooperating, which ultimately leads to the worst possible outcome.
Same goes for the dialogs with unhappy hunters who like 'proof' for the arguments that a bug / vulnerability is not there.
There is literally no financial incentive for me at all to not reward, au contraire actually.