[delayed]

I have paid anonymous security researchers in past bug bounty programs, and would do it again. Way better than paying anonymous ransoms later.

I’ve done the same, but they eventually need to provide a bank account, which generally is at their name

Cryptocurrency is generally preferred by anons in my experience.

They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm). No shit security researchers don't want to give ID scans and biometric data to them.

In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.

The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.

Probably not as much of a filter now that AI is in play though.

That kind of stuff won't work anywhere near as well as a bullshit filter anymore: Most of the bullshit is AI generated and AI has no problem following rules like that-- even better than humans.

Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".

:P

> Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".

I might steal some variation of this!

When you see how shitty many companies are in going after legitimate folks reporting real security vulnerabilities. it frankly shocks me that anyone would ever use their real name.