Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors partici

Strongly agree. The headline appears to me to be borderline deceptive. It strongly implies Airbnb commissioned a formal assessment, not that the authors participated in a bug bounty. Also agreed re: vulnerability numbers. As a rule I typically report multiple vulnerabilities in one endpoint that require chaining or which are all exploited using the same failure as one coherent finding.