Comment by sneela

But also

> violating the 24h promise on their own page

Their page reports: Vulnerability reports will always be responded to as fast as possible - usually within 24 hours.

That's not a promise. I agree regarding the sentiment: "Discord moved to a private, invite-only bounty"... and "refuse to hand over my ID".