Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen twice. There needs to be a bug bounty site with some sort of bug escrow to prevent this behavior.
Edit: pardon the tone, I understand that these types of problems are very very hard to solve because they aren't purely technical and involve humans.
Edit: pardon the tone, I understand that these types of problems are very very hard to solve because they aren't purely technical and involve humans.