Yes, investigating reports is not a sunk cost. Security engineering is all about doing code reviews, which is what this is. There are also ways to optimize wh

Yes, investigating reports is not a sunk cost. Security engineering is all about doing code reviews, which is what this is. There are also ways to optimize which reports you take seriously. The real reason bug bounties are not in place is mostly a combination of insecurity and arrogance.