Security researcher penalised $3750 by Facebook for verifying vulnerability

Posted by kailanb on Wednesday September 22, 2021 @08:18AM
from the philippeharewood.com dept.

https://philippeharewood.com/bulletin-com-email-address-leak/

( 3 comments | 46 points | on HN )

Re:Security researcher penalised $3750 by Facebook for verif... by executive on Wednesday September 22, 2021 @12:57PM (#28618703)

Seems you did not disclose this over the Facebook Portal Smart Video Calling Touch Screen. Consider yourself lucky they did not deduct $7000 instead.

[ Parent | on HN ]

Re:Security researcher penalised $3750 by Facebook for verif... by some_chap on Thursday September 23, 2021 @12:03PM (#28631087)

Hmm, so they reported it to FB & apparently had the vuln confirmed but then retested the vuln a couple of times at 12h & 22h after reporting/confirmation, with the implication that each time they were exposing other user's data...

Not too surprised they reduced the award, tbh...

[ Parent | on HN ]

Re:Security researcher penalised $3750 by Facebook for verif... by 1B05H1N on Thursday September 23, 2021 @11:26PM (#28638302)

Sucks but it goes against their bug bounty tos facebook.com/whitehat.

It's sorta bad to punish folks who have been helping secure the org for a while (in my opinion).

[ Parent | on HN ]