The post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurit

The post had no indication of a bounty being held hostage. From https://www.google.com/about/appsecurity/reward-program/ https://www.google.com/about/appsecurity/reward-program/ it seems like the requirement for a bounty is not for "don't disclose before fix is released", but "don't disclose without reasonable advance notice". So I just don't see the inconsistency here. Project Zero gives a disclosure deadline. The reporter here chose not to give one. When they said they wanted to disclose, there was no stalling for extra time. Just what is the expectation here?