[DaiPlusPlus]

> You fixed it, one less bug to worry about.

Those "bugs" can be features though - or the work involved to fix the bug meant that high-impact feature work - or other bugfixes, had to be postponed or even cancelled.

Our SaaS frequently gets security "researchers" (read: people running online scanners) submitting emails through our contact-form informing us about click-jacking attacks on our login-page - the problem for us is that we have a lot of second-party and third-party integrations on unbounded origins that offer access to our application, and by extension our login-screen through an <iframe> on their own origin, which is sometimes even an on-prem LAN web-server accessed through embedded devices where we can't use popups to do it properly - let alone switch to a more robust OIDC system - so there is no easy solution that makes the "I ran a tool, gimme $100" people go-away without causing a much bigger problem to now exist.

[jrockway]

> there is no easy solution that makes the "I ran a tool, gimme $100" people go-away

I use the "mark as spam" button :)

[staticassertion]

> so there is no easy solution that makes the "I ran a tool, gimme $100" people go-away without causing a much bigger problem to now exist.

Maybe consider setting up a free-tier HackerOne bounty program? I think they triage to some degree on your behalf.

[thaumasiotes]

In the free tier? Triage is a paid service.