Maybe not the vulns. But the interaction with a security researcher. Like this part: "Bluesky has responded to only one of these reports, one time, 4 days after submission, saying "We appreciate the report, and we'll be taking a closer look at the issue.". They did not follow up on that report and they have not responded to any of my other reports."
It shows all signs of a company without a working security process.
Maybe not the vulns. But the interaction with a security researcher. Like this part: "Bluesky has responded to only one of these reports, one time, 4 days after submission, saying "We appreciate the report, and we'll be taking a closer look at the issue.". They did not follow up on that report and they have not responded to any of my other reports."
It shows all signs of a company without a working security process.