I 100% agree with this. I reported to one program, which ignored the report and effectively stalled until the startup had pivoted to a different idea. HackerOn

I 100% agree with this. I reported to one program, which ignored the report and effectively stalled until the startup had pivoted to a different idea. HackerOne didn't remove them from the platform and did not make it possible for me to publish the report through their platform (and publishing it otherwise would have likely violated some ToS). I reported a second issue to Cloudflare. It was acknowledged as a known issue within less than an hour, but still not fixed months later, and again I was unable to publish it. Despite waiting for months and requesting disclosure repeatedly, none of these reports are disclosed yet. In the future, if I find a vulnerability and the only reporting path the company provides is HackerOne, I will apply full disclosure instead.