them: "bug bounty is a scam" their reports:pic.twitter.com/4zT4ibAR8D
-
ummm no- of course it do not how could i find vulnerability in code ive never seen? Oh well- by law then its a duplicate of the submission that triggered the rewrite - even though only thing in common is that it is in the same service. But thank you for the two other vulns :)
You do of course not get a dollar for them as without the last vulnerability in your chain no security boundaries are broken. But we can now see how they can be used together with other vulns and can prioritize the fixes accordingly
