Third to last paragraph: if I sell software, a third party bug bounty type guy finds an exploit, notifies me, I patch the vuln, and release the patch as a hot f

Third to last paragraph: if I sell software, a third party bug bounty type guy finds an exploit, notifies me, I patch the vuln, and release the patch as a hot fix: you figure all of that is SRE, probably? (Disclaimer: not seeking tax advice or legal advice, we’re just two dudes casually discussing section 174 like normal people do all the time). That notice was a helpful read. I think what I may have been missing was section 5 of Rev. Proc. 2000-50, whereunder non-SRE software dev was also afforded some similar protection. I’ll read that after work but I’d still love you to answer the foregoing.