Hacker News Reader

The bounty payouts must be public in order to serve as an incentive.

That incentive works both ways. For instance employee sneaking in a security hole and then selling it to a mate so they can collect the bounty.

Just imagine what the press would be when somebody breaks that NDA

>should be paid multiple years of a high end vuln researcher salary per single discovery

What? Why would anyone work at a company paying them that much less than they pay the contractors?