Researcher banned on Valve's bug bounty program publishes second Steam 0-day
a) Program has scope that doesn't include Xb) Researcher reports vulnerability that falls under Xc) Since it's out of scope, it's closed as N/Ad) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platformWhat's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that.Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.