> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).
On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.
Net net it’s probably positive it’s just too easy to spam these otherwise.
The kind of security researchers who prefer to be entirely anonymous are not seeking monetary rewards from big bounties. No company would pay such researchers anonymously (like using Monero).
They use Persona, which is heavily invested-in by Peter Thiel's Founder's Fund. Peter Thiel, of Palantir (funded initially by In-Q-Tel, the CIA's VC arm).
No shit security researchers don't want to give ID scans and biometric data to them.
No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it.
This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.
A common reporting path for bounties and non-bounty vulnerabilities has always been problematic. This leads to weird scenarios where the company cannot accept reports of denial-of-service vulnerabilities because they are out of scope for bounties, for example. Exclusions from bounties are one thing, but not acting on relevant problems is just a bad idea. The typical bounty program terms are also incompatible with multi-vendor disclosure, where no single vendor can take complete ownership over the disclosure process.
The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.
This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.
But https://docs.bugcrowd.com/researchers/managing-account/accou... says:
> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).
Net net it’s probably positive it’s just too easy to spam these otherwise.
This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.
The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.