We have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole and said "thank you", but declined to pay a donation (see below).
The researcher then sent a follow up email saying that he has found more vulnerabilities, but because we didn't make a donation, he will keep those vulnerabilities for himself.
In other words, he only told us he had more vulnerabilities, but would not disclose them, after we made the decision to not pay the suggested voluntary donation.
To my understanding, this is no longer in line with responsible white hat behavior. Am I right in this assertion?
Yes, the person has been quite explicit in the suggested amount for the donation.
The various reasons include for not paying the requested 'donation' are:
- the suggested height of the 'voluntary donation' in combination with the severity of the vulnerability found,
- the vulnerability in question was, according to our logs, not found by a 'highly skilled' individual, but rather by an automated tool,
- the fact that the Open Bug Bounty project explicitly mentions that no payment is required,
- the passive aggressive tone of voice.
The above, in combination with the fact that, while we are in the process of setting up a bug-bounty budget and associated policy, we haven't completed this yet.
Let's be clear: we did not set a bounty, nor promise one and we did not sign up for this project. The Open Bug Bounty project is an unaffiliated project, that explicitly says: "There is, however, absolutely no obligation or duty to express a gratitude".
Also, note: While I'm in support of some sort of legal framework to protect bona fide security researchers, this legal framework does not, at this moment, exist in our jurisdiction; a fact our legal person was all too keen to point out.