3 ms·

Yes exactly. It would be like Facebook only paying a bug bounty if you can identify the hacker who breached their security.