$3k Bug Bounty – Twitter's OAuth Mistakes

Re:$3k Bug Bounty – Twitter's OAuth Mistakes by edent on Friday December 14, 2018 @12:10PM (#18682420)

I'm sorry that happened to you. I've had mixed success with the large bug bounty sites. Some companies are clearly there as a fig-leaf, and others are unable to handle the large volume of reports they get. But I've found most to be good.

[ Parent | on HN ]

Re:$3k Bug Bounty – Twitter's OAuth Mistakes by philpem on Sunday December 16, 2018 @01:12PM (#18694244)

Yeah I've seen a few patterns with the worse companies...

  * "We've already fixed it" (we haven't but we don't want to pay up, and a fix mysteriously appears a month or three later)
  * "This is not eligible" (we don't actually care)
  * Silence
  * Legal threats ("send us your address so we can send you something for this", and a C&D turns up)

[ Parent | on HN ]