In August, I submitted a security report via the ASR(Apple Security Research Project). The report involves a vulnerability exploitable by malicious actors, potentially granting unauthorized access to Apple ID accounts.
On Aug 31, the Apple security team validated my report, Asking me to keep conversations confidential. They confirmed the issue’s resolution through a system change. Apple asked me to evaluate whether their fix worked and said it would give me credit and other potential rewards when I evaluated and confirmed the problem was resolved.
After I made the vulnerability assessment and confirmation, I heard nothing back. Until recently, I was informed that I was ineligible for credit or other recognition because Apple obtained the vulnerability from other sources.
When I pointed out their previous commitment and their specific policies, Apple modified our conversation record and webpage Fine Print, pretending It was me who hadn’t read it carefully.
This can be verified via the Wayback machine.
(Part of the image has been redacted because Apple still considers it confidential)
Thank you for your advice. I will try to find legal assistance, but this post may be my only way to get a response from Apple.
No. The only way is the legal way. You DON’T want internet attention.
I’m a lawyer. Apple won’t care about your internet post (and may try to find a way to use it as evidence against you if you get into a legal dispute).
You should delete it and look into talking to a lawyer. Apple has already (allegedly) gaslighted you, so why would you posting this on a random internet forum change that?
Reach out to your school/university, a lot have legal/lawyer student resources. Maybe even more if your school has a legal major.