We do not, but I am prepared to pay a bug bounty out of my own compensation, for usual corp reasons. We don’t share this of course unfortunately, so I’m relying on good faith reporters to come forward at which point they get a Willy Wonka ticket if the vuln is legit (and not Burpsuite canned reports or the like). It’s…not ideal. You operate within the org constraints you must operate within.