“Because my bug relied on email spoofing, which was considered "out of scope" for their HackerOne program, they rejected my report.”
A 15-year-old found that a spoofed email to support+id{id}@company.com with a CC added the attacker to any Zendesk ticket, and ticket IDs are incremental. He chained it with Apple ID verification emails into companies’ Slack workspaces and collected more than $50,000 from the companies themselves. Zendesk confirmed a fix two months after the report and paid $0 because he warned its customers. Out of scope meant out of Zendesk’s budget.