Eh I dunno. Google does this with its Vulnerability Reward Program [1] and people seem to be fine with sharing almost all of their private data with Google from

Eh I dunno. Google does this with its Vulnerability Reward Program [1] and people seem to be fine with sharing almost all of their private data with Google from all their e-mails to their credit card numbers (Google checkout), etc., etc. Also Facebook has a form for reporting vulns [2] and people are still happy to share their personal info there. I'm sure there are other companies that have "hotlines" but these are just a few I can think of. I don't think having an avenue for responsible security bug disclosure gives anyone the impression that their data is unsafe. [1] http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... [2] https://www.facebook.com/help/contact.php?show_form=white_hat https://www.facebook.com/help/contact.php?show_form=white_ha...