This is a case where an email from mod zero to security@crowdstrike.com should have been enough to get the SOC to read and route the vuln to the product team an

This is a case where an email from mod zero to security@crowdstrike.com should have been enough to get the SOC to read and route the vuln to the product team and get a fix implemented. NDA? HackerOne? Personal Information with Identity and Credit History Verification, Cookies and Disclosure Agreements, and 3rd party terms? Why is it at all "interesting" that a security researcher is not interested in giving all of up in order to tell CrowdStrike that their core product is broken in a way that is completely inimical to its mission purpose?