Having reported a critical bounty, their incident response and disclosure process is a complete shitshow. Absolute mess of a company.