A Bug in the Bug Bounty

Anecdotally I was snubbed at a younger age when the school district was looking for a security system to prevent manipulating school grades. My suggestion was to remove the disk pack (ok so it was a while ago) that contained student records while the students had access to the system via dialup, and replace it at night when the various accounting programs ran (attendance, grades, etc). Imagine my surprise when the contest ended with no winning solution, but oh by the way we&#x27;ve changed our policy and will not make the student grades data available during the day.<p>We did get them finally fess up that it was my suggestion which they had adopted and they gave me the prize (which was a $250 scholarship as I recall). But it has never ceased to amaze me that people don&#x27;t think of security as holistically as they should.

Prezi&#x27;s apparently trying to cover their posteriors in the wake of Shubham&#x27;s disclosure and subsequent snub ( <a href="http://blog.shubh.am/prezi-bug-bounty/" rel="nofollow">http:&#x2F;&#x2F;blog.shubh.am&#x2F;prezi-bug-bounty&#x2F;</a> ).<p><i>&quot;We greatly value this feedback.&quot;</i><p>Weak sauce. Shubham&#x27;s disclosure saved Prezi from a future nightmare. If they&#x27;re not going to pay him from the bug bounty coffers, they should at least try and sound more like grateful humans rather than a pissy HR department trying to do damage control.

This is a trite response to an actual concern: Placing scope limits on bug bounties is meaningless and dangerous. Hackers will not respect your scope. The scope of a bug bounty program should always be &quot;Anything that affects our, or our users, data or security&quot;.<p>There&#x27;s plenty of non-entities that get reported: Failures of XSS protections on data that is actually public, vulnerabilities on vendors sites that don&#x27;t impact your data, etc. Those should be dealt with with a polite thank you. Everything else should be valid, and everything else should be paid. Possibly not high-tier paid. Have your security team (You don&#x27;t have a security team? Make one, even if it&#x27;s just the coder from your team who has the most experience) triage and report. Fix things, or don&#x27;t, but don&#x27;t be an asshole and try to downplay real issues.

Let&#x27;s all agree that had Shubham not posted what had happened prezi wouldn&#x27;t have done anything. This is just a PR stunt to save face.

I haven&#x27;t been following this story that closely but I just don&#x27;t understand why they don&#x27;t pay him outside the bug bounty.<p>&quot;Sorry this security hole wasn&#x27;t in our bug bounty but we&#x27;d like to give you the reward anyway. Please sign these legal documents and let us know if you find anything else.&quot;<p>There is so much you can do by just being reasonable. Like if Prezi said they can&#x27;t officially acknowledge it under the bug program but can just pay out some sort of reward it makes way more sense.<p>Besides. If the bug was in the code under a subdomain that someone exposed source code it would be the same thing.

Never even heard of Prezi before this. If anything, they should be thanking this guy for all the free publicity.

Kudos to Prezi. They were not obligated to respond this way but they chose to, and I think it is the best response they could have made. I particularly like their statement that they would look to see whether anyone else had found volunteer abilities that also should be rewarded under the new program.

Why don&#x27;t you just pay him for the service he provided you? Is your bounty that high that you can&#x27;t afford to?<p>It seems the negative publicity you are getting is going to cost you more..

They are paying to Shubham. The original post is updated with the emails regarding that. <a href="http://blog.shubh.am/prezi-bug-bounty/" rel="nofollow">http:&#x2F;&#x2F;blog.shubh.am&#x2F;prezi-bug-bounty&#x2F;</a>

I find it more respectable now that I see that Prezi actually posted a public blog post acknowledging their fault in their bounty program.<p>Still, I have to side with Shubham. They should at least reward him now.

The guy finds the company source code wide open and notify them and they treat him like that?<p>Whats up with those people ? They have lost their brain ? or is that inflated egos ?

a blog? I actually expected this to be in a prezi.<p>A few months ago we launched a [Zoom&#x2F;Pan] Bug Bounty Program

The last time I checked Prezi was extremely buggy to the point of being unusable. So they should be very thankful for any bugs reported. Probably their app usability is the consequence of not responding to the user reports.<p>Are they still relying on adobe flash when everyone else moved on?