0·
12 days agoOur security@ address at $dayjob gets about that many a month. Lots of folks blindly sending bug reports and “politely requesting a finder’s fee for disclosing properly.”
The shit of it is, they’ll all for stuff we don’t even use. IIS vuln reports when we only use Apache. Stuff like that.
Depends on whether or not they have local phys.sec and how much of an asshole they want to be.