> Instead, we should have a central vulnerability repository that is open-source, standardized, public, and transparent. This repository should vet vulnerabilit

> Instead, we should have a central vulnerability repository that is open-source, standardized, public, and transparent. This repository should vet vulnerability reports before contacting the software owner prior to disclosure. There are plenty of those. Generally, they take a cut of the bounty.