Real attackers don't think in bug bounty scopes