[everfrustrated]

Seems to me like the game theory here is un-credentialed reporters need to submit their reports through credentialed folks who will vet and take a cut on the way through.

Why take the lower offer by going directly.

That sounds like a win for everyone involved.

[htrp]

still removing work from github.

this is formalizing some very enterprise-esque processes for security research, software resellers anyone?