I would think the fact that they don&#x27;t have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn&#x27;t harm to make that public.<p>On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.