Respectfully disagree with this one. We don't even have a bounty program, and we get at least 10 non-issues for every actual potentially exploitable report.

I can definitely see someone reviewing this and accidentally putting it in the "not a problem" bucket. From our perspective, the best vulnerability reports look like:

"This potential exploit can crash your node"

"This potential exploit can steal user funds"

Etc.

It really helps us filter through the nonsense reports we get.