Hello list, Tonight I'd like to share with you my latest blog post. Seeing my personal experience with the Magento bug bounty program (and even experiences from other security researchers), it looks like they truly believe in a "security through obscurity" methodology. I'm quite disappointed by the fact they tried to downplay the severity of my vulnerabilities, silently patching them after several months, without letting me know their progresses. However, what really disappoints me is that my vulnerabilities seem to be quite critical, specially considering they’re the only two classes of security bugs they’re willing to pay up to 10,000$ under their bug bounty program. I had to ping them several times in order to get my bounties, so I believe they tried to "obscure" and unevaluated my findings not only because of their "security through obscurity" methodology, but probably because they were also hoping I'd never noticed their advisories with my name and the vulnerabilities I reported, and never claimed my bounties for such findings?
Link: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd Best regards, /EgiX _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
