T-Mobile explicitly excludes out-of-date software from their bug bounty program. Same with CSRF and XSS issues. https://www.telekom.com/en/corporate-responsibi

T-Mobile explicitly excludes out-of-date software from their bug bounty program. Same with CSRF and XSS issues. https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/closing-security-gaps-360054 https://www.telekom.com/en/corporate-responsibility/data-pro... Most such issues are business-as-usual there.