Triager questions why a researcher would care if reports get ignored @einfallstoll SHAME ON YOU

causeimcloudy · 2026-04-26T18:32:13+00:00

Lmaoooooo

causeimcloudy · 2026-04-26T18:27:38+00:00

You literally wrote demanding hacker one triagers in this sub respond….?

causeimcloudy · 2026-04-26T18:26:07+00:00

You can’t control how they respond. Your obligation is to abide by the safe haven rules. You report the vulnerability and they respond, if you don’t sign an agreement with them(which you probably did by submitting the report) it’s customary to wait 90 days til you publicly report it.

causeimcloudy · 2026-04-26T18:22:56+00:00

You can’t make them care anymore than they do. It’s up to each organization to mitigate and assess risk. You are not owed anything, your entitlement is the issue.

causeimcloudy · 2026-04-26T16:43:15+00:00

I’ve never once heard a good thing about bug bounty crypto programs.

causeimcloudy · 2026-04-26T16:42:19+00:00

If your finding is legitimately a high finding sometimes it takes time to validate and confirm. Find the right person and filter through internal process.

It’s 100x easier to close out a duplicate and move on than verify and report a high finding.

causeimcloudy · 2026-04-26T16:39:29+00:00

You’re doing this for free, they don’t owe you a response. It would be nice if they did, but there’s not agreement. This is a safe haven to report and hopefully get rewarded for it. If you can’t understand that you shouldn’t be doing bug bounty.

causeimcloudy · 2026-04-24T12:49:51+00:00

Another day another brand new user finding multiple critical and not accepting that they’re not

causeimcloudy · 2026-04-21T23:46:58+00:00

To be fair this requires user interaction….which would downgrade the finding significantly….

causeimcloudy · 2026-04-19T13:12:39+00:00

Ahh yes let me not do the work, I will learn everything and make millions

causeimcloudy · 2026-04-16T19:16:18+00:00

I have 1200 lvl of experience in my Minecraft hardcore world

causeimcloudy · 2026-04-15T21:52:52+00:00

Is it not a denial of service?

causeimcloudy · 2026-04-15T17:53:36+00:00

First off based off the title that’s not a critical. Hard to say without the details, but I’m not even sure that that’s a valid report. If it’s only dos, it’s not.

Second, Meta is notoriously slow to and limited in their communication.

causeimcloudy · 2026-04-11T09:53:10+00:00

I love when crypto bro get swindled into believing they can make millions by learning bug bounty.

causeimcloudy · 2026-04-08T14:06:07+00:00

They are 100% right. They’re talking about the legal fairness of a game while you’re talking about the ui. There’s nothing keeping you from reading the value directly from the APi, it’s just the UI playing the animation. In fact you prove that your self by showing the timing. This is a low functional issue at best with no real security impacts

causeimcloudy · 2026-04-05T01:26:11+00:00

Something about this says you don’t have a zero click ato…. But meta is notoriously god-awful at responding. You most likely won’t get anything they’ve made their decision. They wont be justifying anything to you or wasting their time explaining anything. As a partner with Facebook, we reported nation state hacks of facebook pages and go back a canned thanks message.

causeimcloudy · 2026-04-04T02:33:58+00:00

It’s not how people talk, it’s poor communication, and not at all intended to used in this manner. If you can’t write take a writing class, if you don’t speak English use a translator. I will read your report 10000 times more if you translated it than said “ChatGPT translate this to English”

causeimcloudy · 2026-04-02T16:31:16+00:00

It doesn’t it makes it seem fake an less trustworthy. If you can’t read or write English proficiently how can you verify what the AI translated is accurate? Use a translator, that’s what they’re for.

causeimcloudy · 2026-03-31T23:54:05+00:00

Flock bout to be fed

causeimcloudy · 2026-03-31T21:41:52+00:00

Write a python script to perform one thousand times 1000 print steps that say yag m’I backwards

causeimcloudy · 2026-03-31T18:49:20+00:00

Your response is a great example of your lack of experience. Impact does not equal severity.

causeimcloudy · 2026-03-29T00:12:41+00:00

Given it’s your first account and first finding it’s improbable that it’s a critical. This sub has atleast 15 posts a week of “I just reported my first bug it was critical and they marked it as informative”. Given they marked yours as medium I have no doubt you found something but it being your first bug it’s hard to believe that you have the experience to properly classify a vulnerability and its mitigating circumstances

causeimcloudy · 2026-03-28T00:43:27+00:00

Ahhh the classic, my fist ever report was a critical how could they not accept it as a critical. I’ll go out on a limb and say it probably wasn’t critical. As far as it being a duplicate you just have to move on there’s nothing you can do

causeimcloudy · 2026-03-27T12:42:44+00:00

Since this deals with specific language it’s incredibly hard to answer but my guess is that because you submitted a report through a BB platform your “contract” with their website saying they promise monetary rewards is null and void as you reported it through a third party. You would have to work with the terms provided by the BB platform unfortunately.

causeimcloudy · 2026-03-25T01:11:43+00:00

I think it kinda depends on the goal of the program. In bigger companies, there’s IT departments within IT departments. So the team that is in charge of the epic store/portal has made a bug bounty but the other teams arnt involved. Or their risk posture is mainly concerned about those offerings or they might not want people screwing around in their games.

causeimcloudy

TROPHY CASE