“We found PayPal vulnerabilities and PayPal punished us for it”
HackerOne appears to be completely broken and I wouldn&#x27;t recommend it to anyone.<p>Disagreements are to be expected on a bug bounty platform, but these days they just stop responding altogether and don&#x27;t pay. It borders on outright fraud.<p>I&#x27;ve been trying to report a Squid RCE (CVE-2020-8450) since October. The Squid maintainers seemed unprepared for dealing with the report as they kept being unresponsive and it took 2 months to merge my patch. Maybe they&#x27;re volunteers, so I can&#x27;t blame them. Reported it to the bug bounty [1] which promises high rewards on January 20th and apart from triaging it, there has been radio silence since despite having invoked HackerOne mediation. I have more Squid memory bugs and I&#x27;d rather rm -rf them than go through this process again.<p>HackerOne used to be decent but this appears to be a structural problem now [2].<p>[1] <a href="https:&#x2F;&#x2F;hackerone.com&#x2F;ibb-squid-cache" rel="nofollow">https:&#x2F;&#x2F;hackerone.com&#x2F;ibb-squid-cache</a>
[2] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;DevinStokes&#x2F;status&#x2F;1228014268567547905" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;DevinStokes&#x2F;status&#x2F;1228014268567547905</a>