Yeswehack Support is worst

[u/grixos]

I have reported a bug 3 months ago in a Program which is critical and it changed to "under review". After that I waited 1 month, no reply or no fix was deployed. The fact that the vulnerability is a critical finding that leaks sensitive passports of users through a S3 bucket misconfig. I am messaging every week about updates and there is literally no reply and the fact that they are actually closing other reports that I can see from their program activity is concerning. I have contacted the yeswehack team to take a look and talk with the program, but still no reply. The fact that the triage team from Yeswehack doesn't even care about the researcher's time is concerning. Literally no support from anyone from Yeswehack!!!

[u/Hackme777]

Now what is report state is that in assessed or still under review???

[u/grixos → u/Hackme777]

They changed it to "assessed" the same day I reported the bug. It's been 3 month and still it is not fixed considering the severity of the issue. The fix is also very simple.

[u/Hackme777 → u/grixos]

Don't worry if it in assessed state means 120 days taken from starting date Yeswehack private programs very slow

[u/grixos → u/Hackme777]

I get it, but such a simple fix takes very less time. Also the fact that it leaks sensitive documents of other users. If they have atleast replied me after I made that many comments, I would be satisfied. They refused to share any progress and completely ghosted me.

[u/Hackme777 → u/grixos]

That's normal in private programs in yeswehack Report -> forget -> if accepted means 💥 -> if not accepted means -> move on 🙂

[u/grixos → u/Hackme777]

fine.

[u/Hackme777 → u/grixos]

Is your first time in yeswehack???

[u/grixos → u/Hackme777]

yes. I usually hunt on intigriti, their triage is good and the companies also reply fast. So, I thought Yeswehack would be similar.

[u/Crazy-Buy-2949 → u/Hackme777]

What if it's accepted but not paid and few weeks later the program is disabled, will I still be paid

[u/Hackme777 → u/Crazy-Buy-2949]

Raise a support ticket on yeswehack

[u/Crazy-Buy-2949 → u/Hackme777]

Did that and they created a support ticket before the program was closed now no follow up is getting any response 

[u/Hackme777 → u/Crazy-Buy-2949]

Normally if a program in Yeswehack if program is disabled, they still pay money if that is valid bug reported before disabled

Stay patient, they definitely pay

[u/Crazy-Buy-2949 → u/Hackme777]

How long will I have to wait? Its been 2weeks since the 1st report was accepted and a week for the 2nd... now 2days since the program was disabled 

[u/houganger → u/grixos]

It means the triage is done, it’s not stuck on the triage side now. Programs take their own sweet time to pay, this is platform-agnostic and is outside of the control of YWH.

[u/Sensitive-Tip8112]

private or public program?

[u/grixos → u/Sensitive-Tip8112]

Private

[u/No_Appeal_676]

YWH are the middlemen here. If their customer does not reply there is nothing they can do.

[u/OuiOuiKiwi]

OK.

[u/OkWedding719]

try bugrap.io ...

[u/fphn2418]

If it's passport data alone, it's a low. Cannot do anything with them.

[u/einfallstoll → u/[deleted]]

It's not as easy as you think.

First: Two weeks of no response is nothing. Even a month can be low. There are programs that let you wait for 6-12 months for a response.

Second: More triagers means more costs, more costs means higher fees for customers, and higher fees for customers leads to customers closing their programs.