[fph]

I don't claim to have first-hand experience, that was just a suggestion. But there is a recent study on how maintainers respond to bug bounties here: https://arxiv.org/abs/2409.07670 .

[bayindirh]

Thanks! Got the paper, will read ASAP, hopefully. At the meantime, I have added a couple of real world examples to the comment you originally replied.

So there's some more words from the mouth of the people inside this.