I agree with the concern about bogus reports from automated scanners -- Tarsnap gets a lot of those (run against the website, even though Tarsnap's bug bounties

I agree with the concern about bogus reports from automated scanners -- Tarsnap gets a lot of those (run against the website, even though Tarsnap's bug bounties explicitly exclude the website!). I suspect that if this is useful at all, it's not for serious testers but rather for people who stumble across issues by accident. There are times when I've had to phone a number in whois to report a problem, because all of the contacts on a company's website went to customer support or marketing -- and there was one occasion when I didn't report something I noticed, because the whois was anonymized.