Whilst I&#x27;d agree that bug bounty programmes can be a good idea for Internet facing assets, I thought that this story actually neatly illustrated their limitations.<p>With a bug bounty programme you don&#x27;t generally authorise the kind of post-exploitation activities which we see here as leading to the really serious exposures, and that&#x27;s not surprising as you can&#x27;t easily authorise a set of unknown people to be processing your customer data.<p>This differs from an engaged penetration testing firm, with whom you have a contract which covers things like handling of data gained during a test.<p>So I don&#x27;t really see bug bounties ever replacing penetration testing companies for internal work or anything that requires accessing customer data as part of the exploit...