$1337 is not enough money. A bug like this if used secretly and correctly could have made millions easily.
I've been doing research like this for 5+ years, and you go in knowing most if it won't lead to anything. I'd hoped for more, but I could have simply failed again and got nothing! :)
As I've said below, I'd have reported it anyway even without a bounty; however I probably wouldn't have done the research in the first place were there not a bug bounty programme.
I've previously had 2 bounties from Google. One was an easy find and was also $1337. The other was more technical but still straight forward and also played to SEO and got $5000 - in that instance Matt Cutts was involved and I believe advocated for the amount (thanks, Matt!). This was far more impactful than that other issue, and more directly monetisable.
However, I have to admit it does nag at me a bit that the bounty is so small - it is like they are trying to send a message but I'm just not sure what it is!
I have done loads of research over the last 5 years (this exploit took me a couple of months to craft) and most comes to nothing, and then when I do find something big that the bounty is so small is frustrating. A bigger bounty would have made a meaningful difference to me (kids+no savings!).
The broader issue is how this may play to motivating people to discover/report these sorts of issues in the future. I have a couple of other ideas for search related attacks, but am not sure I'm going to explore them any longer.
Agreed. Relative to the value of exercising this exploit, your bounty is missing a few 0’s at the end. I hope that you at least get some professional credit for this, and that it translates to a financial boost. You certainly deserve it for discovering something like this and doing the right thing with it.
The fact is that these bug bounty programs should start paying competitive prices. They can lowball it by 10x-20x at most, but lowballing by 1000x leads to people just giving up their ethics.
Uncovering bugs that aren't attached to bug bounty programs still has external benefits for the security community.
Thanks for your work here, even without such a program.
For example I could leverage the equity of a US made second hand car marketplace and to rank my site in the UK and list UK Autotrader listings on my site. They have a nice affiliate program for clicks/leads.
Alternatively, I may only operate in one country but I could 'top up' by equity by leeching it from a company in a similar niche in another country. My competitors in my home country would be at a loss to how I'm ranking so well.
It should be noted that there are a number of parameters that may change between my initial experiment and these uses, so we'll never know how viable it really was.
https://www.blackhatworld.com/seo/immediately-be-in-the-top-...