We bootstrap security teams in a long-term engagement. We staff bug bounty programs, but do not bill for that service separately. If a client uses H1 and pays t

We bootstrap security teams in a long-term engagement. We staff bug bounty programs, but do not bill for that service separately. If a client uses H1 and pays them for triage, it fairly straightforwardly removes a cost for us. The bug bounty nonsense spray I'm talking about is "sev crit: DMARC is set to quarantine instead of reject" and literal descriptions of how session cookies work (that inexplicably get paid out for: we've seen it happen). I assume we're in agreement I should not be fine with people putting that in pentest reports; if that's the case, the quote is not really controversial: all it says is that H1 has a lot of nonsense reports. The mechanism GP describes would require Latacora to be a proxy good for H1. Do you believe that is the case?