> (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.) In my uneducated opinion,

> (If GH don't want to pony up the T-shirt, that's fine, but they can't send customer notifications before the researcher publishes.) In my uneducated opinion, that seems like a really good way to judge whether something qualifies as worthy of a bug bounty etc.