I Got Paid $0 from the Uber Security Bug Bounty

Re:I Got Paid $0 from the Uber Security Bug Bounty by sushid on Sunday December 24, 2017 @03:21PM (#16001153)

Not the parent commenter and I get what you mean, but if they state that it's a duplicate issue (and assuming on good faith that it is), doesn't it make sense that they don't pay you out for that?

I'm 100% on your side regarding the XSS issue but you can't expect them to have a list of security vulnerabilities that they've already discovered at your disposal.

[ Parent | on HN ]

Re:I Got Paid $0 from the Uber Security Bug Bounty by chris_wot on Sunday December 24, 2017 @04:48PM (#16001457)

Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented.

Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!

[ Parent | on HN ]