I submitted this privately via the MSRC Portal and followed CVD guidelines for over 90 days. I spent months appealing and emphasizing the technical severity to

I submitted this privately via the MSRC Portal and followed CVD guidelines for over 90 days. I spent months appealing and emphasizing the technical severity to them. The result was always the same: They admitted the technical fix (Status: Complete), but refused the bounty claiming 'Content Policy'. I am only sharing this now because I have exhausted all internal appeals and they stopped responding.