Comment by celesian

This reminds me on how Spotify's bug bounty program keeps receiving vulnerability reports about Shopify, and how Shopify keeps receiving vulnerability reports from Spotify. This went so far that they had to explicitly put the other company's domain as out of scope on their bug bounty policy.