{"id":"https://openalex.org/W3203171300","doi":"https://doi.org/10.1145/3475716.3484193","title":"Why Some Bug-bounty Vulnerability Reports are Invalid?","display_name":"Why Some Bug-bounty Vulnerability Reports are Invalid?","publication_year":2021,"publication_date":"2021-10-06","ids":{"openalex":"https://openalex.org/W3203171300","doi":"https://doi.org/10.1145/3475716.3484193","mag":"3203171300"},"language":"en","primary_location":{"id":"doi:10.1145/3475716.3484193","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3475716.3484193","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018227159","display_name":"Saman Shafigh","orcid":null},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Saman Shafigh","raw_affiliation_strings":["University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042705320","display_name":"Boualem Benatallah","orcid":"https://orcid.org/0000-0002-8805-1130"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Boualem Benatallah","raw_affiliation_strings":["University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076865166","display_name":"Carlos Rodr\u00edguez","orcid":"https://orcid.org/0000-0002-7263-821X"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]},{"id":"https://openalex.org/I322348216","display_name":"Universidad Cat\u00f3lica Nuestra Se\u00f1ora de la Asunci\u00f3n","ror":"https://ror.org/04jjna482","country_code":"PY","type":"education","lineage":["https://openalex.org/I322348216"]}],"countries":["AU","PY"],"is_corresponding":false,"raw_author_name":"Carlos Rodr\u00edguez","raw_affiliation_strings":["Universidad Cat\u00f3lica Nuestra Se\u00f1ora de la Asunci\u00f3n, Asunci\u00f3n, Paraguay - Visting Fellow, University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universidad Cat\u00f3lica Nuestra Se\u00f1ora de la Asunci\u00f3n, Asunci\u00f3n, Paraguay - Visting Fellow, University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571","https://openalex.org/I322348216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5013446207","display_name":"Mortada Al-Banna","orcid":null},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mortada Al-Banna","raw_affiliation_strings":["University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5113,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.62497178,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scope","display_name":"Scope (computer science)","score":0.8899244666099548},{"id":"https://openalex.org/keywords/popularity","display_name":"Popularity","score":0.7525207996368408},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6204289197921753},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.5984277129173279},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5720846056938171},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.4512627422809601},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.38075268268585205},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.33684706687927246},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.33491015434265137},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.24802884459495544},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.0829242467880249}],"concepts":[{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.8899244666099548},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.7525207996368408},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6204289197921753},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.5984277129173279},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5720846056938171},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.4512627422809601},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.38075268268585205},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.33684706687927246},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33491015434265137},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.24802884459495544},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0829242467880249},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3475716.3484193","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3475716.3484193","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W37678429","https://openalex.org/W180288257","https://openalex.org/W1628063087","https://openalex.org/W1707806712","https://openalex.org/W2065598226","https://openalex.org/W2113585710","https://openalex.org/W2114712239","https://openalex.org/W2117405938","https://openalex.org/W2136213879","https://openalex.org/W2221883063","https://openalex.org/W2513442265","https://openalex.org/W2520816865","https://openalex.org/W2524848955","https://openalex.org/W2551929716","https://openalex.org/W2621131828","https://openalex.org/W2621759135","https://openalex.org/W2727861051","https://openalex.org/W2754913139","https://openalex.org/W2878668565","https://openalex.org/W2962783287","https://openalex.org/W3102446060"],"related_works":["https://openalex.org/W2368605798","https://openalex.org/W2518037665","https://openalex.org/W2348524959","https://openalex.org/W2477036161","https://openalex.org/W2368049389","https://openalex.org/W2384861574","https://openalex.org/W2170801710","https://openalex.org/W2952704802","https://openalex.org/W4294565801","https://openalex.org/W2142306706"],"abstract_inverted_index":{"Background:":[0],"Despite":[1],"the":[2,16,61,86,100,111,128,154,163,189,199,208,230,238],"increasing":[3],"popularity":[4],"of":[5,18,23,30,63,130,157,165,191,202,232,240],"bug-bounty":[6,35,124,223],"platforms":[7,36,125,224],"in":[8,82,121,194,243],"industry,":[9],"little":[10],"empirical":[11,76],"evidence":[12],"exists":[13],"to":[14,48,69,84,110,126,146,152,162,182,215,227,249,253,262,279,299],"identify":[15],"nature":[17,231],"invalid":[19,24,67,80,93,233,265],"vulnerability":[20,192,212,241,260,271],"reports.":[21,167,204,234,266],"Mitigation":[22],"reports":[25,53,64,81,89,106,151,245],"is":[26,99,198],"a":[27,136,180,277,296],"serious":[28],"concern":[29],"organisations":[31,294],"running":[32],"or":[33],"using":[34],"as":[37,39,56,66,92,175,276,295,307],"well":[38],"security":[40],"researchers.":[41],"Aims:":[42],"In":[43],"this":[44,158],"work":[45],"we":[46,95,115,142],"aim":[47],"identify:":[49],"(i)":[50],"why":[51],"some":[52],"are":[54,60,90],"considered":[55,65],"invalid?":[57],"(ii)":[58],"what":[59],"characteristics":[62,129],"due":[68],"being":[70],"out-of-scope?":[71],"Method:":[72],"We":[73,134,169,186,205],"conducted":[74],"an":[75,131,283],"study":[77,220],"on":[78,259],"disclosed":[79],"HackerOne":[83,149],"examine":[85],"reasons":[87,178],"these":[88,166],"marked":[91],"and":[94,141,225,304],"found":[96,187],"that":[97,160,188],"out-of-scope":[98,105,132,138,150,171,203,284,289],"leading":[101,155,200],"reason.":[102],"Since":[103],"all":[104,117],"were":[107],"rejected":[108],"according":[109,214],"programs":[112,118],"policy":[113,119,216,302],"page":[114,303],"studied":[116],"pages":[120],"two":[122,176],"major":[123],"understand":[127,229],"report.":[133,285],"developed":[135],"generalised":[137,288],"taxonomy":[139,196,290],"model":[140,145,159,197,291,298],"used":[143,248,275],"our":[144,195,287],"further":[147],"analyse":[148],"find":[153],"attributes":[156],"contributes":[161],"fate":[164],"Results:":[168],"identified":[170,207],"followed":[172],"by":[173],"false-positive":[174],"main":[177],"for":[179],"report":[181],"be":[183,247,274],"deemed":[184],"invalid.":[185],"attribute":[190],"type":[193,242],"characteristic":[201],"also":[206],"top":[209,268],"9":[210,269],"out-of-interest":[211,270],"types":[213,261,272],"pages.":[217],"Conclusions:":[218],"Our":[219,235,267],"can":[221,246,273,292],"help":[222],"researchers":[226],"better":[228,263],"finding":[236],"about":[237],"importance":[239],"validating":[244],"justify":[250],"future":[251],"works":[252],"develop":[254],"automated":[255],"classification":[256],"techniques":[257],"based":[258],"triage":[264],"blacklist":[278],"automatically":[280],"classify":[281],"possibly":[282],"Finally":[286],"guide":[293],"base":[297],"create":[300],"their":[301],"tailor":[305],"it":[306],"they":[308],"need.":[309]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}