Amazon packaging feedback cross-site scripting vulnerability (bitquark.co.uk)

I've sometimes wondered if code I've worked on will ever make it onto HN.

This was not the preferred way ;)

Though in my defense, this code was written before I got there... But I'm pretty sure I've been through this exact code afterwards and never found the vulnerability.

I reported a different vulnerability to Amazon a few days ago. I've gotten a case number, but haven't heard anything beyond that. It's nice to see their timeline and know that they are responding and fixing stuff.

I wonder why Amazon doesn't offer a bounty, even one that is a token amount.

I would be curious if the author would have investigated further if he knew for certain no monetary benefit would have been given by Amazon.