Zendesk Sacred out of Scope

[pdelteil]

The problem with this report is that they use the out of scope rule as a sacred text.

The objetive of setting "DMARC, DKIM and SPF" as out of scope is because it's easy to spoof an email address but the impact is low or None. Mostly because it's harder to spoof emails and bypass anti spam protections, often times the spoofed emails only reaching the spam folder if ever.

But that doesn't mean that spoofing an email is always None/Informative in every condition. The most important part of a bug is the impact, from the company's perspective at least.

The company and Hackerone's triagers failed to estimate and understand what the reporter was saying or trying to prove, adult professionals couldn't understand a 15 years old hacker just because they were closed minded with a sacred rule: Out Of Scope means OOS!