Title: I found a DOS vulnerability in an Open Source project whose maintainer seems to be MIA at the moment. I found it in-the-wild, but not as an exploit so I&#x27;ve only made minimal effort to contact said maintainer - no surprise I haven&#x27;t gotten a response so far.<p>I don&#x27;t want to draw any attention to it in a bug report and I&#x27;m not sure it&#x27;s OK to dig up email addresses from commit logs either.<p>It also got me thinking: why don&#x27;t we have a Bug Bounty-like program for Open Source projects as a whole. What I mean is somewhere where we can post sensitive bugs (even for no pay) and have someone who knows what they&#x27;re doing guide the process of reporting it responsibly. I know some big projects have this, but e.g. look at the mountain of dependencies that most projects are built on - many of them barely maintained.
Upvote: