News for hackers. Stuff that matters.

A comment on Disclosure: Unlimited Chase Ultimate Rewards Points. Parent comment

Re:Disclosure: Unlimited Chase Ultimate Rewards Points by ic4l on Wednesday November 04, 2020 @08:02AM (#24988606)
I agree, especially with risky parties like banks, or government institutions.

It's always a scary experience.

The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports.

Since then they did develop a disclosure program, but it would be great to hear from anyone else that reported things to them after the end of 2017.

[ Parent | on HN ]
Re:Disclosure: Unlimited Chase Ultimate Rewards Points by tyingq on Wednesday November 04, 2020 @08:29AM (#24988796)
"The funny thing is according to them I was the only contributor from 2016 to the end of 2017. So they must not get many reports."

Probably because there's no obvious way to submit one.

[ Parent | on HN ]
Re:Disclosure: Unlimited Chase Ultimate Rewards Points by ic4l on Wednesday November 04, 2020 @08:35AM (#24988851)
They had one a few months after

https://responsibledisclosure.jpmorganchase.com/hc/en-us

[ Parent | on HN ]
Re:Disclosure: Unlimited Chase Ultimate Rewards Points by Defenestresque on Wednesday November 04, 2020 @12:51PM (#24991302)
>All attack payload data must use professional language

Huh.

[ Parent | on HN ]
Re:Disclosure: Unlimited Chase Ultimate Rewards Points by aidenn0 on Wednesday November 04, 2020 @07:42PM (#24994608)
They probably want to check PoC into their repository and banks take a very dim view on unprofessional language in the DB. I would only be slightly surprised had the terms included: "All code must be written while wearing professional attire"
[ Parent | on HN ]