[realchucknorris]

am i wrong or security researchers aren't paid well. i mean not sure how much this bug is wort but def. $3500 looks like a small number.

[anotheraccountf]

Yeah, I had the same thought. For something as big as this? Should be at least 2 more zeros imo.

[imtringued]

I don't understand what's so big about this. It's akin to telling someone that they forgot to use passwords on their mongodb database. Does that really deserve $350k compensation?

[anotheraccountf]

Depending on what a black hat could do with the data in your database, it might absolutely be worth it. I understand that 350k is way more than bug bounties usually pay, but 3.5k is taking advantage of people's ethics to outsource your security.

Let's put it another way: The team who discovered this has skills WELL worth 350k for a year's worth a work. How many security issues would they have to catch for it to be "worth it"? Maybe more than 1, but 100 show stopping vulnerabilities for 350k is crazy to me.

edit: ESPECIALLY slack, if it was possible to use this to get access to any chat logs.

[tptacek]

No, none of this is how vulnerability research compensation works.