points by lrvick 1 day ago | 0 comments
In all past bug bounty programs I started I made it clear we would only prioritize findings as serious if PGP encrypted to the security team PGP key to review offline.
The serious researchers all knew how to do this and complied and usually got paid, and the unencrypted stuff was basically always noise we never paid out on.
Probably not as much of a filter now that AI is in play though.
Instead, you'll need something like "you must enroll your pgp fingerprint in our system by sending a handwritten postcard featuring a tourist attraction in your region".
:P