Most of these findings would have been discovered during an in depth pentest. While I applaud Uber (or any company) for having a bug bounty program, it does no

Most of these findings would have been discovered during an in depth pentest. While I applaud Uber (or any company) for having a bug bounty program, it does not replace mandatory application pentests for new features and major modifications. Each bug bounty paid out should result in a meeting to discover not only how the vulnerability was introduced, but how it was missed in QA and SQA.