[hansvm]

> when you could just push a change to prod instead.

I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty and the developers' bias against inaction.

[Thorrez]

How about this one: https://hackerone.com/reports/745324

It's a $20k bounty for simply taking a cookie that a HackerOne employee accidentally pasted when responding to a different vuln report on HackerOne.

[azeirah]

100%, hacking is as much technical prowess as it is social engineering.