alt Hacker NewsI assumed that the ID requirement was about sanctions compliance - OpenAI can't legally send money to someone in North Korea, for example.
But https://docs.bugcrowd.com/researchers/managing-account/accou... says:
> To improve platform integrity by reducing high volumes of low-quality submissions, identity verification (IDV) is now mandatory for all researchers before submitting reports to Managed Bug Bounty (MBB) programs (public and private, excluding on-demand MBBs).
Replies
On one hand, this is valid. On the other hand, security researchers can be some uber-paranoid weirdos who prefer to be entirely anonymous, and this could have a chilling effect.
Net net it’s probably positive it’s just too easy to spam these otherwise.
No. All bounty programs allowed submissions without ID, compliance came into play only if you were given a reward and decided to accept it.
This was moved to the front of the reporting process specifically to combat AI-generated vuln report spam - basically, requiring you to "burn" your real ID if you're submitting slop. Kinda ironic that this is now preventing people from submitting security reports to AI companies.
Pay anonymous whitehats for their time or they may come back as blackhats.