@phurd@infosec.exchange True, but the payouts are still real. https://cyberpress.org/github-pays-100000-bounty-for-critical-rce-flaw/