Playstation confirms chain of 5 vulnerabilities on PS4/PS5
The disclosure timeline is interesting:<p>- theflow0
submitted a report to PlayStation.
Oct 25th (8 months ago)<p>- PlayStation rewarded theflow0 with a $20,000 bounty.
Nov 12th (7 months ago)<p>- shoshin_cup
PlayStation staff closed the report and changed the status to Resolved.
Apr 4th (3 months ago)<p>- theflow0
requested to disclose this report.
Apr 4th (3 months ago)<p>- sazerac
HackerOne staff agreed to disclose this report.
Jun 10th (9 days ago)<p>I generally refuse to participate in Bug bounty programs through intermediaries like HackerOne, because they severely restrict and delay your ability to disclose. After having been denied a bug bounty for reporting a vulnerability directly, and often spent frustrating amounts of time just trying to get a response even from major companies, I&#x27;ve basically given up completely on bug bounty programs, and will likely go for full disclosure in the future (with a note to the corresponding security team for awareness).<p>For smaller issues, the bounties often don&#x27;t even fairly compensate the (usually significant) effort spent communicating with the security team if you value your time at a competitive hourly rate, and payment is hit or miss. Not worth giving up your right to talk about the issues in exchange.