I made this

Well, they did it anyways, so…

Also this might work as an answer to “yeah, it’s a bug, but we won’t pay you”

I couldn’t help but find it amusing—they were now asking me to keep the report confidential, despite having initially dismissed it as out of scope.

“Sorry, but per your own guidelines this is out of scope. Because of this, this bug is not part of the agreement and guidelines on Hackerone. You can find my full disclosure, that I wrote after your dismissal here: <Link>” /s

I did that once with another company. The result was that I got an abuse complaint from them and my domain got on a spam blacklist for a while.

Since then, for such mails it’s only abuse reports and sinkhole their domain if possible.

GAST