2. It is not the case that all reporters want their findings disclosed publicly, even if they're rejected.
3. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform.
4. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.
As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA conditional on following the disclosure guidelines. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony.
Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me.
Strongly agree on all other points though.
You need permission to pentest someone else's systems, you don't need permission to pentest software on your own systems even if that software is written by someone else. In an enterprise setting it's possible that you have signed a contract where you agree not to do such testing or not to publicize its results; but violating that would be a civil matter regarding the terms of that contract, not a felony in respect to CFAA.
There is no such thing as a retroactive crime in rule of law systems. Disclosure could be a considered an offense in its own, though.
But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.
You don't have to get into legal trouble to see which way the wind is blowing.
However, why doesn't H1 expressly allow reporters the option of public disclosure for all NA or WONTFIX reports?
My presumption is that the "other reasons" are business/political and centered around the desire to provide value to or establish goodwill with corporate partners.
In reality, valid bugs being quashed by vendors is not the real problem H1 has.
In this particular case, is sounds like H1 (or an employee thereof) actively discouraged disclosure, which seems like a problem.
> In reality, valid bugs being quashed by vendors is not the real problem H1 has.
There can clearly be more than one problem. I still fail to see the relevance of the "bug report quality" problem to this discussion (beyond explaining why automatic disclosure of NA/WONTFIX reports is not helpful.)