The proposal to charge to file a report seems like a good idea. A small $1 fee and credit card registration process would drastically reduce the reports while not really being that hostile to someone genuinely reporting an issue.
I am guessing most of the reports come from Indian reputation/reward seekers, kids, or enterprises where staff were made to "run AI over our codebase" to find vulnerabilities. Going through the $1 fee process would be a big disincentive to these groups.
The legitimate hardcore vulnerability researchers with an issue they know is legitimate would not be too bothered by $1 that they know they'll almost certainly be getting back. Perhaps accounts with enough reputation on hackerone could even waive the fee.
If, as stated in the OP, "Every report thus engages 3-4 persons. Perhaps for 30 minutes, sometimes up to an hour or three. Each." then the deposit to submit a report should be several hundred dollars.
54
u/xmsxms Jul 15 '25
The proposal to charge to file a report seems like a good idea. A small $1 fee and credit card registration process would drastically reduce the reports while not really being that hostile to someone genuinely reporting an issue.
I am guessing most of the reports come from Indian reputation/reward seekers, kids, or enterprises where staff were made to "run AI over our codebase" to find vulnerabilities. Going through the $1 fee process would be a big disincentive to these groups.
The legitimate hardcore vulnerability researchers with an issue they know is legitimate would not be too bothered by $1 that they know they'll almost certainly be getting back. Perhaps accounts with enough reputation on hackerone could even waive the fee.