Post #3656077

2026-07-07 19:15 UTC

Has anyone ever refused a bug bounty payment? Curious…. I mean, if the only way to report a bug to some company is via a bug bounty program, is it possible to say “no thanks” on the payout? Or have them donate it to the #eff? I’d be interested in hearing about any such thing happening. #infosec #security #bugbounty

Replies (2)

@joshbressers@infosec.exchange 2026-07-07 19:21

@simplenomad@rigor-mortis.nmrc.org I’ve done several things like this and requested passing the EFF. The taxes weren’t going to be worth it

Open ##3656076
@AlesandroOrtiz@infosec.exchange 2026-07-07 20:52

@simplenomad@rigor-mortis.nmrc.org Many have to do this due to their employers prohibiting payments from other companies. These policies are usually in place to avoid ethical or contractual issues. Others donate out of generosity. A good example of this is Seunghyun Lee, who has made large donations to picoCTF: https://www.cmu.edu/news/stories/archives/2025/january/student-bug-bounty-discovery-supports-picoctfs-cybersecurity-education-efforts-with-462000-gift If you search the Chromium issue tracker, there are multiple cases of folks donating rewards to EFF and other charities for either of the reasons I mentioned.

Open ##3657665