Over a year ago, I have reported a few security vulnerabilities to one of the top bug bounty programs on HackerOne. All of them have been quickly triaged as critical, but no progress was made towards their resolution. I have repeatedly pinged them for update, but every time I have received evasive answers. The program response efficiency metrics seem to indicate that is not the case with other reports, or at least some of them. What should I do in this situation? I have already tried HackerOne mediation system with no success.
As many experts would agree, it is time you follow the (not so desireable) second-part of resposible disclosure: Give the security team a timeframe of 1-3 months, after wich you will disclose the vulnerability.
Responsible disclosure isn't only about communicating with the developer team to fix their security issues; It is about evaluating on your own just how much of an impact the vulnerability has, and how much time is reasonable to fix it. It would be unfair to the users to keep a critical vulnerability un-fixed and un-reported, given how much of an impact it would have if actively exploited. Sadly, sometimes the only way of making a company react, is by publishing your findings.
This was not legal advice; This was not advice; I am not responsible for the actions of those who read this.