OP here. I understand the essence of your point and agree with it to some extent, but I think in this instance I wasn't clear. Google are transparent about the

OP here. I understand the essence of your point and agree with it to some extent, but I think in this instance I wasn't clear. Google are transparent about their process and let me know they'd vote on it at their next meeting. I've clarified the language in my post. The idea of an intermediary is an interesting one, certainly for smaller companies. However, for the company to be able to work out the value of the bug, they'd need to know enough details to 'score' the bug such they could maybe find it. Either way, you'd end up needing some trust. However, the idea of a service to manage all that for small companies is a good idea. It reminds me of the Common Vulnerability Scoring System (http://www.first.org/cvss http://www.first.org/cvss) for scoring such exploits.