If you're not going to win a prize, why would you need to be kept in the loop about an internal vulnerability that is being worked on? As for getting a prize,

If you're not going to win a prize, why would you need to be kept in the loop about an internal vulnerability that is being worked on? As for getting a prize, it goes back to the dupe issue which is the source of a lot of abuse. There's no way to prove you also worked on it or if you just got the info from your friend and want to double your winnings.