Yes, which is exactly why you should not trust it. Bounties are no substitute for an audit by professional (or academic) security researchers, and if the expect

Yes, which is exactly why you should not trust it. Bounties are no substitute for an audit by professional (or academic) security researchers, and if the expected value of exploiting the vulnerability (i.e. to the NSA) is greater than the bounty payout, the person who discovers it would do better to sit on the information. From 1998: https://www.schneier.com/crypto-gram/archives/1998/1215.html https://www.schneier.com/crypto-gram/archives/1998/1215.html