It really has got to the point now where it is very unusual for one of the reports I log to actually get a payout within the programme's published scope.

What is more normal is that they will either make-up a reason for why it isn't in scope at all, or will downgrade the impact without any explanation or comment.

I obviously understand that sometimes there are good reasons for a downgrade. Over the years I have landed plenty of RCEs, only to find that they are in a locked-down container, with no data or useable pivot, and which quickly recycle as soon as the RCE is detected by XDR. Interesting, but no real impact. Bah.

But the situations I'm describing aren't that. They're vanilla bugs as per the platform taxonomy.

For example, I log quite a few blind, stored XSS that end up in admin pages. These often dump back loads of data to the collaborator platform, often 100s of MB, including PII and other sensitive stuff.…