[bb1996]

Maybe it has something to do with the rise in AI slop reoorts but it's ironic since hackerone now has HAI for crafting and assisting in write ups. I have been trying for the past year or two now to submit valid vulnerabilites only for triagers to not even look at my proof of conceot and close reports right away.

I had one subdomain takeover for a program on intigriti and provided evidence of the takeover and the triager closed the report right away. I submitted a screenshot of the takeover in my browser (chances are they didn't even care to look at it)
Another instance last year I had a jailbreak prompt on Google Gemini and reported only to find out that they don't accept jailbreaks and they closed the report but told me to go to another channel for reporting.
One of my other findings was an exposed red team portal on Shopify and they ended up claiming that it was meant to be public facing but I tried arguing the risk of it being public facing yet they acted like there was no risk of it being exposed to the internet.
I also found a valid Cisco Plugin vulnerability on another program on hackerone and it was marked as duplicate but when I still go to the endpoint 6+ months later the vulnerability is still working. This one was according to them "a duplicate of another report" if that's the case why hasn't it been fixed yet if someone else reported it before me?

I'm not asking for a kings ransom here for bounty rewards bit even some acknowledgement would go a long way instead of just closing the report and trying to claim "this falls under hypothetical" when I literally give you the evidence you need.

I feel like I am ranting at this point but I just wanted to vent my frustrations, and I honestly don't blame other hackers who turn to the darkside when it comes to selling exploits and vulnerabilites.

I plan on quitting bug bounty because of the unethical ways these "programs" operate and treat people who want to protect their applications. Its a waste of time now.

[Guns3524]

bro, honestly? I understand your frustration. Ive seen tons of similar situations myself. Triagers close reports especially on H1 and Intigritti.

Unfortunately, since the AI ​​started generating slop en masse, the quality of the trias has dropped. Many hunters have the exact same problems as you.

a few tips before submitting a report:
Reports must be crystal clear even if you have a good POC. Poor description = instant rejection
Always provide a clear business impact
Subdomain takeovers - almost no one pays well anymore unless they use a full chain to take over an account
On duplicates - a screenshot sometimes helps but not always

Many good hunters left for a while and then returned switched to private programs/red teaming or simply their own research projects. Hang in there.

[psycheuser]

The duplication thing is the biggest scam in modern bug bounty. If it's a duplicate from 6 months ago and still unpatched, they are basically using the first report as a shield to get free data and avoid paying out new researchers. Triagers these days just look for any reason to close a ticket instead of actually assessing risk. Totally understand the frustration mate, the whole system is broken.

[1111110101]

That sounds awful. I never used intrigiti myself but I’ve always heard bad things about it. Synack tends to be a bit better when it comes to personal comms with triagers but they have their own set of rules as well so they won’t hesitate to reject if any of the rules are not met. Their dupes system is a lot better since it shows you what’s been submitted in that asset. It is more closed group and the top earners have their own houses and group of people working 24/7 but if you are in USA or FVEY you’ll have extra specific listings.

Another thing you can do is google dork open bug programs from the actual company pages.

The money is there regardless of AI but yeah it does feel very sloppy right now with everything going on. But I’d change platforms if haven’t, bugcrowd I haven’t heard anything too bad about it either.