DHS officially uses bugcrowd, for what it's worth. https://bugcrowd.com/engagements/dhs-vdp https://bugcrowd.com/engagements/dhs-vdp They've had that relation

DHS officially uses bugcrowd, for what it's worth. https://bugcrowd.com/engagements/dhs-vdp https://bugcrowd.com/engagements/dhs-vdp They've had that relationship for a few years now, so I'm guessing they're somewhat versed. TSA specifically might be less so, but I can't imagine the DHS referring anything to the DOJ for prosecution given that they both have a VDP for the entire department and advise other departments on how to run VDPs (via CISA). But I might just be overly optimistic.