4 ms·

They don’t need to pay out anything.

• belter 5y ago
  You have a point there and the researcher has also no obligation of disclosing it to them.
  • latch 5y ago
    But they do have obligations that make it otherwise worthless to the them.
    • ClumsyPilot 5y ago
      They could contact a three letter agency, that's totally legal. Or they could release information publically, without informing M$
      • manbart 5y ago
        Apparently it would also be legal to sell it to authoritarian regimes a la NSO
      • abledon 5y ago
        sell it to FBI/CIA< and they use it on Azure China run by 21Vianet ?