There are legit security researchers out there, doing good work and finding real issues, but the vast, vast majority are … not that. If you open a security bug bounty program, for example, you’ll mostly get either auto-generated garbage like this, or just super generic non-issues like exposing numeric ids to clients, using anything less than the strictest CSP headers, etc.
I’m actually surprised there aren’t MORE bogus CVEs out there, based on my experience with bug bounty programs.
I’m actually surprised there aren’t MORE bogus CVEs out there, based on my experience with bug bounty programs.