Has anyone ever refused a bug bounty payment? Curious….
I mean, if the only way to report a bug to some company is via a bug bounty program, is it possible to say “no thanks” on the payout? Or have them donate it to the #eff? I’d be interested in hearing about any such thing happening.
@simplenomad I’ve done several things like this and requested passing the EFF. The taxes weren’t going to be worth it
@joshbressers When I worked at MITRE I reported several bugs anonymously since I also worked on the CVE project and was told by work not to report things because it would “look weird”. No bug bounty involved, but yeah going to the EFF makes sense. Glad someone is doing it!
@simplenomad Many have to do this due to their employers prohibiting payments from other companies. These policies are usually in place to avoid ethical or contractual issues.
Others donate out of generosity. A good example of this is Seunghyun Lee, who has made large donations to picoCTF: https://www.cmu.edu/news/stories/archives/2025/january/student-bug-bounty-discovery-supports-picoctfs-cybersecurity-education-efforts-with-462000-gift
If you search the Chromium issue tracker, there are multiple cases of folks donating rewards to EFF and other charities for either of the reasons I mentioned.
@simplenomad I also have personally rejected a couple of bug bounties from vendors who wanted full NDA or other onerous terms, not in good faith. These were vendors without formal bug bounties, many years ago. Obviously didn't have chance to donate to charity since their intent was to prohibit disclosure of vulnerabilities.
@AlesandroOrtiz Same! In the ancient past I was even threatened with legal action from a vendor if I disclosed a security bug (that they silently patched). Things have changed a lot since then.
@simplenomad I'm still afraid of being served a lawsuit for work I did a couple of years ago.
It's great to be in our industry, isn't it? 😅
@AlesandroOrtiz And people wonder why we were using hacker "handles" for so long... we were justifyingly paranoid. It has gotten better, but still very far from perfect.