Fixed, then told.

Vulnerabilities published only when both sides consent — the reporter offers, the program approves. Private programs never publish.

Published findings

Nothing published yet — resolved reports appear here once reporter and program both agree.

Award amounts stay private — the bounty panel never publishes.