AFAICT, Apple's security bounty program is officially only for their preselected group of security researchers. In the course of developing my current applicat

AFAICT, Apple's security bounty program is officially only for their preselected group of security researchers. In the course of developing my current application, I've discovered a couple security bugs in macOS, which I reported to Apple product security in PGP-encrypted emails. The only thing offered to me was to have my name/company listed in the release notes (which they are, for the latest 10.13 update, along with a CVE#).