Hacker News Reader

> Sooo, after around 3 months it ended as-is: "Important, Spoofing" and that the desktop client - remote code execution - is "out of scope".

literally unbelievable. wow.

View on HN

Its out of scope because the scope microsofts bug bounty programm is limited to web applications and endpoints.

Honestly, for a severe finding like this in their product I think they should have:

a) Paid out a bonus anyways for the finding (bug bounties do this often, certainly we did at Dropbox)

b) Made this scoping issue more explicit somewhere

This certainly isn't something that is listed on their bug bounty page, and would also be a ridiculous limitation in reality considering the scope of Microsoft's services.

Are we looking at the same page?

Here https://www.microsoft.com/en-us/msrc/bounty-microsoft-cloud is a header "IN-SCOPE DOMAINS AND ENDPOINTS" with alist of domains and that is described with the following: "Only the following domains and endpoints are eligible for bug bounty awards."

I couldn't find something that would match the Teams app on general bug bounty website either (https://www.microsoft.com/de-de/msrc/bounty)

I would assume it would be under the Microsoft office insider bug bounty.

This is incredibly believable for Teams development and bug fixing timelines.

Reply on news.ycombinator.com