yep and you can also "audit" these things at a nice premium for a day job as well the hackerone bug bounty formalization was just getting up to speed, but the

yep and you can also "audit" these things at a nice premium for a day job as well the hackerone bug bounty formalization was just getting up to speed, but the competition has greatly expanded. exploit, audit, bug bounty.. its all semantics in my opinion. you get paid, and you have to weigh what kind of liability you create. where's the distinction? Even people that go straight through hackerone or some company's bug program wind up with undue liability, its still better not to be known in your most "compliant" way