> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).
No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it.
This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.
A common reporting path for bounties and non-bounty vulnerabilities has always been problematic. This leads to weird scenarios where the company cannot accept reports of denial-of-service vulnerabilities because they are out of scope for bounties, for example. Exclusions from bounties are one thing, but not acting on relevant problems is just a bad idea. The typical bounty program terms are also incompatible with multi-vendor disclosure, where no single vendor can take complete ownership over the disclosure process.
The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.
That's not why. OpenAI is run by a virus. On two different dates I submitted a vulnerability disclosure or bug and on both occasions I had my account closed shortly thereafter (I've been trying to reopen the first account for the past 2 months.) So, the virus wants the biometric information so it can close the user's account.
This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.
it's so interesting that claude does this. I think most normal people would say "requires" or maybe "needs". Sometimes you hear this when someone is struggling to fill in a webpage ("this login page wants a password but I don't remember mine"), but rarely when it comes to "bounties" which are more rarely personified. Like no one would say "the gold medal at the olympics wants a record score".
23 comments
[ 0.25 ms ] story [ 16.7 ms ] threadBut https://docs.bugcrowd.com/researchers/managing-account/accou... says:
> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).
This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.
The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.
https://imgur.com/a/zBDLXwX
The virus marked it as "ignored" after about 2 seconds. (OpenAI has some models that run at 10,000 tokens per second.)
I’m not disputing your experiences, I believe what happened to your accounts did happen.
But especially for your second example, it’s a clear case of correlation =/= causation; and drawing an inference like that is strange.
You can also find news reports of the virus firing OpenAI security researchers.
The companies can pay market value. Someone will.
No I won't sign an NDA.
No, I won't sign your obscene contract.
No, I won't agree to a 90/120/180/360 day embargo.
No, I don't care about your customers or shareholders.
Simply put: fuck you, pay me. Or, find out.