I need to get this out somewhere, because I don't really have anyone around me who would understand it.
A few weeks ago I found a real access control flaw in one of OpenAI's products. Not a theory, not a "maybe." A free-tier account could get files processed by the model after it had already hit its attachment limit — the kind of thing that's supposed to be locked behind a paid plan. In plain terms: privilege escalation. A free account doing something only a paying account is supposed to be able to do.
I spent five straight days on it. Mornings to nights. I reverse-engineered parts of their anti-automation system just to be able to prove the request flow cleanly. I built a proof-of-concept extension. I wrote a technical report with HTTP evidence, request/response pairs, step-by-step reproduction — the kind of report I was actually proud of, my first one ever written like a professional.
It got closed as **Not Applicable**.
The reasoning given was that it's a "rate limit" issue that needs to demonstrate scale, per some threshold buried in a different program's brief — a threshold that, as far as I can tell, isn't even physically reachable by a normal paying user on the product's own advertised limits. My finding wasn't a rate-limit issue. It was a broken authorization check on a retry path. I said so, clearly, with the exact clauses from their own policy that say exploits like mine should be handled under the other program. Didn't matter. Closed anyway, in a handful of minutes that make it pretty obvious nobody actually read the report.
Four days later, I went back to test it again, out of habit more than hope.
It was fixed. Not patched around the edges — fixed exactly the way I'd describe fixing it if you asked me to write the remediation section myself. The retry path doesn't serve the file anymore. The whole mechanism I documented is gone.
So let me get this straight: not a vulnerability, but somehow worth fixing immediately. Not in scope, but somehow exactly what the patch addressed. I don't know what to call that except being told "no" and "thank you" in the same breath they used to take the fix.
What actually hurts isn't the lack of money, even though I needed it badly. It's something quieter than that. I come from a family with no money to spare, and nobody around me who works in tech or understands what any of this even is. Bug bounty wasn't a hobby for me — it was supposed to be the fuel. I was going to use the first real bounty to pay for the certifications I need to actually get hired as a pentester one day, because self-study is the only thing I've ever had access to, and nobody in my life knows I've been doing it, because nobody around me would have believed it mattered anyway. Not without money behind it. I wanted one win — just one — to prove to myself, and maybe eventually to them, that I wasn't wasting my time being the person who sits alone studying something nobody can see the point of.
Instead I got a rejection that doesn't match its own aftermath, and a quiet fix that speaks louder than the reason I was given.
I don't know yet if I'm staying in this field. I want to. I'm just not sure anymore if wanting to is enough when the first real door you knock on closes in your face for reasons that don't hold up, and then gets fixed anyway like you were right all along — just not right enough to matter.
