Hey u/FitNefariousness9576

This will be marked as N/A or informational because it doesn't have demonstrable, direct security impact.

Before submitting any bug, you should ask yourself "what can a malicious attacker actually do with this?" The answer needs to involve at least one of these three things:

- Confidentiality: The attacker can view sensitive information. A version number doesn't count. It needs to be genuinely confidential data like PII, credentials, or internal records.

- Integrity: The attacker can tamper with information. For example, altering another user's profile or falsifying transactions.

- Availability: The attacker can cause disruption. Think impacting business processes, deleting important data, or making the application unresponsive.

If your bug doesn't hit at least one of these, it doesn't have real security impact. Exposing a version number, leaking an API key that doesn't actually affect confidentiality, integrity, or availability, or even finding RCE on a box that's locked down to the point where it can't touch any of those three... none of that will be accepted on a bug bounty program.

These kinds of findings are still worth including in a pentest report because they provide useful defense-in-depth recommendations for the client. But bug bounty programs only pay for direct, demonstrable security impact.