Re:I Got Paid $0 from the Uber Security Bug Bounty
by EnFinlay on Sunday December 24, 2017 @02:27PM
(#16000909)
> Then they disabled completely the Uber Report Issue button
I don't have enough signal to make a report, but the button doesn't 404 for me, so my guess is you've been shadowbanned.
> then surely they could cite to the prior report or an internal ticket to that effect
Yeah, they should, at least to build the relationship. Public programs have so many erroneous report they probably stopped doing the "nice" thing ages ago.
> But the best part is, when I was reporting various issues to the Bug Bounty, their staff is actively fixing stuff on the backend - that XSS issue they were trying to fix on the backend, but without paying anything for the discovery. I was getting different application responses after the initial report, but only until I gave them more info on the WAF and XSS_Auditor evasion stuff did they finally pull the whole application offline. And then still didn't pay.
If this is true, that's really bad. I'd be curious to hear the other side of the story if there is one.
I don't have enough signal to make a report, but the button doesn't 404 for me, so my guess is you've been shadowbanned.
> then surely they could cite to the prior report or an internal ticket to that effect
Yeah, they should, at least to build the relationship. Public programs have so many erroneous report they probably stopped doing the "nice" thing ages ago.
> But the best part is, when I was reporting various issues to the Bug Bounty, their staff is actively fixing stuff on the backend - that XSS issue they were trying to fix on the backend, but without paying anything for the discovery. I was getting different application responses after the initial report, but only until I gave them more info on the WAF and XSS_Auditor evasion stuff did they finally pull the whole application offline. And then still didn't pay.
If this is true, that's really bad. I'd be curious to hear the other side of the story if there is one.