I'm getting pretty fucking tired of how HackerOne and Bugcrowd handle researchers, especially newcomers.

And no, I'm not complaining because I expect every report to be accepted or rewarded. I know duplicates happen, I know false positives exist, and I know not every bug has a security impact.

But there's a difference between rejecting a report for legitimate technical reasons and having a system full of contradictory decisions, unresolved issues, and increasingly restrictive rules for researchers.

Let's start with HackerOne.

You spend days auditing code, reverse engineering, building PoCs, and documenting a vulnerability, only to find out it's a duplicate of something reported ages ago.

Fine, somebody got there first.

But what really pisses me off is discovering how many old findings are apparently still unresolved, or cases where a fix appears to have been implemented but the report hasn't reached a proper final state.

Why is managing these issues apparently so difficult?

How many researchers are…