Reported a subdomain takeover on a host that was in scope when I tested. Two days later the scope page no longer lists that wildcard, and triage has closed the report as out of scope.
I have a screenshot with a timestamp. I am not trying to start a fight, I just want to know what is normal. Is this something you push back on, or do you take the loss and move on?
Push back, politely, once. Attach the timestamped scope and say plainly that the test was authorised when it happened.
Most of the time this is not malice — someone tightened the scope for unrelated reasons and triage is reading today's page. A good program fixes it when you show them. If they do not, you have learned something about the program that is worth more than the bounty.
Screenshot the scope page before you start. Every time. It takes four seconds and it has saved me this exact argument twice.
Worth noting the scope on this platform is versioned on the program record, so there is a history to point at rather than your word against theirs.