Yeah, the signal to noise ratio on vulnerability reports is very weak, especially when the initial report withholds any detail.
replyI get tons of these messages too and the ones that do include details are the kind of junk you get from free "website vulnerability scanners" that are a bunch of garbage that means nothing -- "missing headers" for things I didn't set on purpose, "information disclosure vulnerabilities" for things that are intentionally there, etc... You can put google.com into these things and get dozens of results.
I run bug bounty for a fairly large OSS project and the amount of shitty/bad actor spam/beg bounties etc we get is huge.
Like 95% of the emails to security@ are straight garbage
replyFrom the looks of it, they actually asked for a way to report.
replyemail security@company
replySure that is perhaps a good way to inquire about the appropriate channels to disclose a security vulnerability, but email is not a secure communication method for sending the details about a security vulnerability
replyIt's kind of insane to think that the state of email encryption is still so bad in The Future Year 2026.
replyNo flying cars? Okay. Nobody traveled much beyond the orbit of the Moon? Dang. But email? We didn't even get reliable privacy separate from identity?
> Nobody traveled much beyond the orbit of the Moon?
replyOh, don't think that outer space will let you escape the misery of email:
> "I have two Microsoft Outlooks and neither one is working": Artemis II astronauts
start there and handle everything once you get in contact with appropriate people
replyYeah. I'm just saying how it could have been overlooked. Doesn't excuse it, though.
reply