TobyI don't know enough about security research. For a project like Node.js does stopping bug bounties drastically impact anything?
On the face of it, no money means people may be less incentivised to help or report, which feels bad.
But Node.js is a massive concern, so is there enough goodwill and surface area that people will help and report anyway? Simply because big orgs rely on it?
https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties
Deadliftbear