<story><title>A Bug in the Bug Bounty</title><url>http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/</url></story><parent_chain><item><author>MrZongle2</author><text>Prezi&amp;#x27;s apparently trying to cover their posteriors in the wake of Shubham&amp;#x27;s disclosure and subsequent snub ( &lt;a href=&quot;http://blog.shubh.am/prezi-bug-bounty/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.shubh.am&amp;#x2F;prezi-bug-bounty&amp;#x2F;&lt;/a&gt; ).&lt;p&gt;&lt;i&gt;&amp;quot;We greatly value this feedback.&amp;quot;&lt;/i&gt;&lt;p&gt;Weak sauce.  Shubham&amp;#x27;s disclosure saved Prezi from a future nightmare.  If they&amp;#x27;re not going to pay him from the bug bounty coffers, they should at least try and sound more like grateful humans rather than a pissy HR department trying to do damage control.</text></item></parent_chain><comment><author>kbenson</author><text>I think that&amp;#x27;s a bit harsh.  I read the full email exchange he posted at the end of his article[1], and they went to some length to explain their position at the end of that exchange, and while I and many other wish it was different, I find their position &lt;i&gt;understandable&lt;/i&gt;.  With any number of past security submissions already deemed inadmissible for a bounty based on being out of bounds, how do they justify doing it in this one case?  I think they were heading this direction anyway, and if anything this just sped up the time frame.&lt;p&gt;1: &lt;a href=&quot;http://blog.shubh.am/wp-content/uploads/2013/12/LetterLog_Prezi.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.shubh.am&amp;#x2F;wp-content&amp;#x2F;uploads&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;LetterLog_Pr...&lt;/a&gt;</text></comment>
<story><title>A Bug in the Bug Bounty</title><url>http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/</url></story><parent_chain><item><author>MrZongle2</author><text>Prezi&amp;#x27;s apparently trying to cover their posteriors in the wake of Shubham&amp;#x27;s disclosure and subsequent snub ( &lt;a href=&quot;http://blog.shubh.am/prezi-bug-bounty/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.shubh.am&amp;#x2F;prezi-bug-bounty&amp;#x2F;&lt;/a&gt; ).&lt;p&gt;&lt;i&gt;&amp;quot;We greatly value this feedback.&amp;quot;&lt;/i&gt;&lt;p&gt;Weak sauce.  Shubham&amp;#x27;s disclosure saved Prezi from a future nightmare.  If they&amp;#x27;re not going to pay him from the bug bounty coffers, they should at least try and sound more like grateful humans rather than a pissy HR department trying to do damage control.</text></item></parent_chain><comment><author>dnautics</author><text>&lt;i&gt;Whilst waiting for their response, I realised that I would rather not accept their “swag”, and decided to instead, send off an email indicating why I wished to walk away with nothing....&lt;p&gt;Anyways, they did try and get it right, by emailing me an apology as well as responding to my constructive criticism.&lt;/i&gt;&lt;p&gt;Before shubham posted anything.</text></comment>