> They politely replied that they don’t provide bug bounties and the endpoints have been patched.
Yeah. No wonder people are selling this stuff.
Yeah. No wonder people are selling this stuff.
Oh, you don't do a bug bounty, and you say it's fixed when it clearly isn't? Okay, then it shouldn't be a problem if I publicly name, shame and provide a POC for everyone to see.
Though, I'm sure most people would just sell it to a vulnerability broker instead and make a quick buck.
Note: Such a platform I'm invisioning here would definitely be illegal. I'm aware.
It’s like obligating companies to have a user feedback program.
Some of them even have „autoshops“ where you can sell cc info to the system with price limit and buyers get matched like in a financial market with an orderbook. No shit