We do. We have not yet documented this publicly, but will setup something like a Hackerone profile soon.