Google Praised Researcher's 'Nice Catch' Then Denied Bug Bounty — Flaw Still Unpatched
Security researcher Justin O'Leary reported a privilege-escalation vulnerability in Google's Config Connector, initially accepted as high-priority and high-severity. Google's representative even praised it as a 'Nice catch!' but later reversed course, declaring the behavior 'working as intended,' refusing to pay a bounty and leaving the flaw unpatched.
Highlights
- Researcher Justin O'Leary discovered a privilege-escalation vulnerability in Google Config Connector and received initial high-priority, high-severity classification from Google.
- A Google representative praised O'Leary with 'Nice catch!' before the company reversed its position and declared the behavior 'working as intended.'
- Google refused to pay any bug bounty and has not released a patch for the reported Config Connector flaw.
- Despite Google's official reversal, the bug report remains internally flagged as high-priority, contradicting the company's public stance.
- The incident has intensified scrutiny of big tech Bug Bounty Programs and the risk researchers face when companies unilaterally change vulnerability acceptance criteria.
Google Praised Researcher's 'Nice Catch' Then Denied Bug Bounty — Flaw Still Unpatched
Security researcher Justin O'Leary has disclosed a puzzling experience involving Google's bug bounty program: after reporting a privilege-escalation vulnerability in Google's Config Connector, the company initially accepted the submission under a high-priority, high-severity classification — and a Google representative even praised him with the words "Nice catch!"
Google subsequently reversed its position, however, declaring that the behavior was "working as intended" and that no vulnerability existed. As a result, the company declined to issue any bounty payment and has not released a patch.
According to a report by technology outlet The Register, despite Google's official change of stance, the bug report remains internally flagged as high-priority within the company's systems — a detail that highlights a stark contradiction between Google's internal handling of the issue and its public-facing position.
The incident has reignited debate within the security research community about the fairness of big tech companies' Bug Bounty Programs. Researchers invest significant time and effort to responsibly disclose vulnerabilities, yet they risk receiving nothing if a company unilaterally redefines its acceptance criteria after the fact.
Google has not issued a public response to the matter, and it remains unclear whether the Config Connector privilege-escalation flaw will ever be addressed.
原文來源： 查看原文
FAQ
Newsletter
Subscribe to our Low-Altitude Industry Newsletter
Daily curated news on low-altitude economy and drone industry, delivered to your inbox.
Reviewed and published by the LAETimes editorial desk ·
