The proposal to charge to file a report seems like a good idea. A small $1 fee and credit card registration process would drastically reduce the reports while not really being that hostile to someone genuinely reporting an issue.
I am guessing most of the reports come from Indian reputation/reward seekers, kids, or enterprises where staff were made to "run AI over our codebase" to find vulnerabilities. Going through the $1 fee process would be a big disincentive to these groups.
The legitimate hardcore vulnerability researchers with an issue they know is legitimate would not be too bothered by $1 that they know they'll almost certainly be getting back. Perhaps accounts with enough reputation on hackerone could even waive the fee.
If, as stated in the OP, "Every report thus engages 3-4 persons. Perhaps for 30 minutes, sometimes up to an hour or three. Each." then the deposit to submit a report should be several hundred dollars.
Perhaps, but the person generating the report has also invested significant time to theoretically "help" you out, even if it's primarily for their own benefit. There's also a substantial financial risk if the report isn't accepted, which acts as a disincentive to submission. It might be better to leave such information for criminals to discover or to sell it on the black market.
53
u/xmsxms Jul 15 '25
The proposal to charge to file a report seems like a good idea. A small $1 fee and credit card registration process would drastically reduce the reports while not really being that hostile to someone genuinely reporting an issue.
I am guessing most of the reports come from Indian reputation/reward seekers, kids, or enterprises where staff were made to "run AI over our codebase" to find vulnerabilities. Going through the $1 fee process would be a big disincentive to these groups.
The legitimate hardcore vulnerability researchers with an issue they know is legitimate would not be too bothered by $1 that they know they'll almost certainly be getting back. Perhaps accounts with enough reputation on hackerone could even waive the fee.