When is a vulnerability not a vulnerability?
Sep 5, 2018 · 5 min read
Recently, I was discussing the types of submissions that are often declined by bug bounty programs with Tomer Schwartz, who works as part of the Microsoft Security Response Center (MSRC). Unfortunately, sometimes he is the person who has to do the declining. He said, “Sometimes a vulnerability just isn’t a vulnerability”. You might think this sounds wrong, but let’s talk about what he meant.
The OWASP Top Ten is often quoted by those who make bug submissions, as though OWASP are the authority on all things web application security. While I do agree that…
