At 7:10 p.m, a new scope was added to
@omidxrz
's watch on BC. By 9 p.m, I had reported 14 XSS vulnerabilities, all of them triaged by Bugcrowd. The next day, the company marked the domain as out of scope and awarded me a $500 bonus(P2). However, they duplicated all the reports.