(Too late to edit my post) After reading the article, I now don't think it's as misleading as the parent portrayed. >As part of a novel security assessment pr

(Too late to edit my post) After reading the article, I now don't think it's as misleading as the parent portrayed. >As part of a novel security assessment program for its vendors and partners, Dropbox in 2018 began privately offering rewards to top hackers to find holes in Zoom’s software code and that of a few other companies. The former Dropbox engineers said they were stunned by the volume and severity of the security flaws that hackers discovered in Zoom’s code — and troubled by Zoom’s slowness in fixing them. >After Dropbox presented the hackers’ findings from the Singapore event to Zoom Video Communications, the California company behind the videoconferencing service, it took more than three months for Zoom to fix the bug, the former engineers said. Zoom patched the vulnerability only after another hacker publicized a different security flaw with the same root cause. This is pretty specific, and does seem to be quite unusual and well beyond the scope of a typical vendor assessment/compliance process. And the particular details about Zoom's response (delaying fixing until they received another report of a bug with the same cause) don't sound great. I do still think it's a common pattern to see vague and sensationalized reporting about infosec matters, but I don't think that's necessarily the case here. My fault for not looking at the article myself and just trusting the parent.