“We found PayPal vulnerabilities and PayPal punished us for it”
People have a weird mental model of how big-company bug bounty programs work. Paypal --- a big company for sure, with a large and talented application security team --- is not interested in stiffing researchers out of bounties. They have literally no incentive to do so. In fact: the people tasked with running the bounty probably have the opposite incentive: the program looks better when it is paying out bounties for strong findings.<p>Here are the vulnerabilities in their report:<p>1. They can suppress a new-computer login challenge (they call this &quot;2FA&quot;, but this is a risk-based login or anti-ATO feature, not 2FA).<p>2. They can register accounts for one phone, then change it to another phone, to &quot;bypass&quot; phone number confirmation.<p>3. There are risk-based controls in Paypal that prevent transactions when anomalies are detected, and some of them can apparently be defeated with brute force.<p>4. They can change names on accounts they control.<p>5. They found what appears to be self-XSS in a support chat system.<p>6. They found what appears to be self-XSS in the security questions challenge inputs.<p>None of these are sev:hi vulnerabilities, let alone &quot;critical&quot;. 2 of them --- #4 and #6 --- are duplicates of other people&#x27;s issues. Self-XSS vulnerabilities are often excluded entirely from bounty programs.<p>For the last 3 hours, the top comment on this thread has been an analysis saying that, because Paypal is PCI-encumbered, and HackerOne reports can function as &quot;assessments&quot; for PCI attestations, Paypal is in danger of losing its PCI status (and the fact that it won&#x27;t is evidence that they are &quot;too big to fail&quot;). To put it gently: that is not how any of this stuff works. In reality, formal bug bounty programs are a firehose of reports suggesting that DKIM configuration quirks are critical vulnerabilities, and nobody in the world would expect any kind of regulatory outcome simply from the way a bounty report does or doesn&#x27;t get handled. It should, I hope, go without saying that nobody is required to run a bounty in the first place, and most companies probably shouldn&#x27;t.<p>The login challenge bypass finding was actually interesting (it would be more interesting if they fully disclosed what it was and what Paypal&#x27;s response was). But these reporters have crudded up their story with standard bug-bounty-reporter hype, and made it very difficult to judge what they found. I&#x27;m inclined not to believe their claim that Paypal acted abusively here (and I am not a fan of Paypal).