I commented earlier to sort of the same effect, and was thinking a little more about this.<p>I don&#x27;t think the goal, or desire, is to be told the full extent or impact of a problem.  The goal is to be alerted to spots that may lead to a large problem, or re in and of themselves a large problem.<p>This seems like it has a few facets to it.  You end up reducing the space of things to mostly &quot;ways to get in the front door.&quot;  Thinking about it, I would probably be frustrated, in general, if I knew someone had important keys to the kingdom I was in charge of.  It doesn&#x27;t change the fact that others may or may not have also gotten the same access, now it&#x27;s 1-* instead of 0-* people who have it and shouldn&#x27;t.<p>I&#x27;m still slightly skeptical on the bounty reward itself.  This was a simple exploit that got pivoted into some major shit, so do you reward the exploit of the logical conclusion of the exploit? I lean towards the latter, but again, as you said... how do you figure out the impact without... actually trying to figure out the impact?<p>Bug bounties are an interesting concept, to be sure.
-