Researcher banned on Valve's bug bounty program publishes second Steam 0-day
a) Program has scope that doesn't include X<p>b) Researcher reports vulnerability that falls under X<p>c) Since it's out of scope, it's closed as N/A<p>d) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platform<p>What's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that.<p>Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.