Notes on “Notes on “a little note”.”

First off, spare us the advertising. Nobody here cares.

--

  this is not a vulnerability
  
  Unfortunately, we then received this message from
  Anshuman:
  
  “I am giving you a heads up that I will be blogging about
  this sometime today. Thanks for your time.”

So he reported a bug. You think it's not a vulnerability. This means to any reasonable human that you're literally giving him free reign to talk about it in whatever forum he prefers, including his blog, since there is no vulnerability and as such no danger to you or any of your users. Further, if you feel he misrepresented, he let you know he'd blogged so you were in a position to present your disagreeing position there.

This leaves us with one question, which you didn't even bother to try and address: Why is his doing that "unfortunately"?

Now, you've admitted that all of the blame for the fallout of the second bug report falls in your hands because you failed to communicate in a reasonable timeframe.

The HackerOne FAQ does state: "No. It is unacceptable to share the vulnerability with anyone without the explicit consent of the Response Team."

However this following sentence from you remains due to the facts of the matter, and your own admission, simply wrong:

  You have twice gone against the spirit of a bug bounty
  program by disclosing things without consent.

The first disclosure may have been of a bug of some kind, but not of a vulnerability (as determined by yourself) and is as such not covered by the FAQ.

In the second case, as per your own admission, you failed to honor the implicit contract of the situation, which unbound him further from the rules.

So you'll be hard pressed to argue in any way that your claim of him having gone against the spirit of the bug bounty program twice is correct.

This leaves the issue of his banning from your program, which is doubly by your admission, based on wrong claims.

--

I will not speculate on your real intentions here, but i will let you know that everything you have done looks like you have ulterior motives. The post you made, while wordy, utterly fails as an excuse or even apology, the last of which you are due for.

Now have your upvote so people can see what kind of behavior they can expect from Slack.