^ personally, i am of the opinion that full disclosure best disclosure.

if bug bounties could give, instead of money or swag, useful knowledge, no matter how old (src, internal docs, build artifacts with private symbols, stuff like that which *should be* the currency of infosec); then i'd maybe reconsider. unfortunately that's not likely to happen in an era where such things are called Imaginary Property, given imaginary values, and hoarded instead of preserved.