I was poking around one of Google's lesser known programs, Build with Chrome, when I noticed something pretty funny with their search bar. When you type in the standard XSS payload
<script>alert(1);</script>, the notification pops up as if the site were vulnerable to XSS. But here is the funny thing. If you change it at all, (like to
<script>alert(2);</script>), then nothing happens.
After puzzling over this, the only thing I can come up with is that some snickering developer at Google thought it would be funny to send a bunch of people down a bunny trail, and inserted an if statement in the search that said if somebody searched for
<script>alert(1);</script>, it would display a notification with '1'. Is this a wise security practice?
It seems to me that there are two sides to this. One the one hand, if attackers are so focused on a fake vulnerability, they will be less likely to find the real ones. But on the other hand, I bet Google has gotten over a thousand reports for the bug bounty program just on this one vulnerability. This makes it harder to glean out the good reports.
So here is my question: is it a good security practice to use sneaky little fake vulnerabilities to protect yourself, or is it more work than it saves?