On: Auditing GitHub users’ SSH key quality

[jessaustin]

Given their customer base, that sort of response would have kicked off a shit-storm. ISTM that any "responsible disclosure" ought to at least rate a T-shirt. (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.)

[benjojo12 → jessaustin]

I'm not saying that I didnt get anything for it what so ever, The peer of mine did manage to send over some swag as a thanks, I now have http://i.imgur.com/d2f7mcD.png on my work desk :)

[robzyb → jessaustin]

> (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.)

In my uneducated opinion, that seems like a really good way to judge whether something qualifies as worthy of a bug bounty etc.