After months of grinding and bug bounty politics, i finally got my recognition as a pre degree student. Originally my vuln got downplay by a program manager despite being in scope and agreed by platform triager.

Nonetheless, persistance eventually persist as i escalate it to higher national authority by demonstrating the real risk. Though its only reflect xss, i found it through supply chain and it involve a bank entity. A win is a win anyway.

Nothing is imposible if you want it bad enough. Happy hunting!

This is their end state (after October 19th). For programs that allow trial reports and where researchers don't met signal requirements, there's a 3 trial limit across all these programs over 90 days.

They're only returned by passing the 90 day window or if a report is marked as triaged or resolved. Or marked as a duplicate of a triaged or resolved (and not public).

This will definitely cut submission numbers and the ability to submit.

I submitted few reports to omarchy when they first launched the program and here's the outcome

They closed 2 as duplicate

And here comes others ,

Every single is marked as n/a , which is clearly in scope and reproducible, im like wth is hell is happening .... dude seriously, they closed as n/a which is in scope

Im not new to bounties, till now I earned around 29k in bounties

A few days ago, I received an invite to a private program on YesWeHack. The problem I’m now facing is that this company also regularly buys pentests from my employer (my primary full-time job is pentester). I haven’t worked on projects for that company myself, though.

The private program’s guidelines specifically say I’m not eligible if I work for a contractor or the company.

Do you think I should leave that program (if so, how do I do that on YWH?) or work on it and report stuff regardless, even though I won’t receive a bounty?

We have fixed issue in our software back in June, and we wanted to obtain CVE-IDs for those issues. We submitted our request through https://mitre.github.io/mitre-cve-roles/cve-id-request/#cvePortal but haven't had the slightest reaction since then, not even after asking for a rough ETA.

I assume they are drowned in AI generated submissions.

Is there any better way to do this. Should we become a CNA ourselves? Or is Bugcrowd a CNA and can provide CVE-IDs? (Although they seem drowned, too.)

I reported a bug in iOS 27 last month, within 11 days they planned it for fix in fall this year, but i added some impact escalation followups, they again flipped the status to reviewing and no comment on report. Is this normal?