Security Vulnerability Disclosure

You won't fire off a quick email nor warn others because there's no bug bounty?

Responsible disclosure was given. Developer doesn't seem keen on changing things.

You reported it through their security bug reporting form, twice. That's sufficient for now. There are two reasons they may not have acknowledged it.1. You haven't given them enough time to acknowledge it.2. They are not acknowledging it to limit their liability. Suppose a black hat subsequently finds it and uses it to cause harm, and a victim sues. The acknowledgement to you could be used as proof that they knew about the bug before it was exploited.You've done all you s

Ever reported a security vulnerability to a company and had it severely downplayed before?

This reads more like an advertisement for the person who wrote the post - as they did not even discover the bug, just led security response.

How did the author "fuck with" the company beyond discovering a vulnerability and helping them fix it?

Hey! I'm part of Harvest Security Team. We'll be changing the way we do this, but by the time this happened I triaged the report after reading it because it really looked legit. The reality is that we were never able to reproduce and there was no explicit fix.The issue stayed on Triage state and I missed the reporter updates. I talked to the author of the post and I believe we are in good terms now.The security and privacy of our customers is extremely important to us, everythin

Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger.Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking.What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has 2 options, admit it was their fault and the vulnerabilit

hey maintainer herewe've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issueswe're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

A lot of Google employees are reading HN and actively posting so no surprise. Did they at least contacted you to properly open a ticket now that they implicitely recognized the vulnerability? Otherwise very very dickish move as it solve nothing and you basically worked for free...