Do companies refuse to fix RCE, XXE, etc?

Starter Zone
1

The question is pretty straightforward do companies with bounties ever refuse to fix RCE, XXE, etc.? We don’t like spending time finding bugs no one will fix, especially critical bugs. It really bothers us when important bugs aren’t fixed.

1 Like
2

Why shouldn’t they fix it, if they pay someone to find such vulnerabilities? Isn’t that the spirit of Bug Bounty?

1 Like
3

PatrikF,
Not all bounties are equal. We hope for that spirit, but many bounties don’t have it and ignore critical bugs. Those types of companies make bounties because they look good to their customers, board of directors, and if publicly traded it looks good to stock holders.

1 Like
4

I had a directly opposite situation. Mail.ru paid for XXE that was out of scope.

1 Like
5

Thanks! That’s been recorded on the spreadsheet of company responses with your handle. https://docs.google.com/spreadsheets/d/1ovzdpsEjGTplUC2kaUaMZcXRJzaM9FmnMX5NGXl0cyo/edit#gid=0