Hacker News Reader

I managed to manually produce this bug 2 months ago. As they don't have any bug bounty, I didn't submitted it. By starting a conversation and refreshing before ChatGPT has time to answer, I managed to reproduce this bug 2-3 times in January.

View on HN

did you reach out via https://openai.com/security.txt?

No, as I said, their disclosure page says there is no and I'm not a professional security researcher so I was not very interested in helping them.

I find even it funny now, they could write that they will provide free API creds, but now they had a very bad moment due to their greed.

*there is no bug bounty

Missed a word.

You won't fire off a quick email nor warn others because there's no bug bounty?

Not everyone has the privilege of working for free

As I understand, the "work" was already done, the only thing missing was sending a heads-up email with "hey, this seems iffy, maybe you ought to look into it".

I dunno, I generally report issues I find in software, paid or not, as I've always done. Takes usually ~10 minutes and 1% of the time, they ask for more details and I spend maybe 20 minutes more to fill out some more details.

Never been paid for it ever, most I gotten was a free yearly subscription. But in general I do it because I want what I use to be less buggy.

Sending an email is work too.

Reply on news.ycombinator.com