[RHSeeger]

Then they should provide a path that doesn't involve arbitrary NDAs if you're willing to forego the reward.

[tptacek]

That path already exists: it's called "email security@vendor, tell them what you found, ask when a patch is expected, and then tell them they have 60 days".