Comment by deckar01

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independently discovered. I would like to see status updates from developers. I would like to see some kind of shared compensation system that acknowledges it can take more than one person to investigate a problem before it is fixable and that even time spent replicating a vulnerability has value.