Yeah, I can attest to that. Found a github page with ssh keys, home directories, infrastructure scripts, configs, etc for Comcast that could&#x27;ve been used to do just about anything within their infrastructure. I raised the issue as ethically as I could, particularly since someone with an &quot;infosec background&quot; already forked it a bit before I found it. The engineers who I got in contact with were hugely appreciative, got the issue fixed almost immediately (seriously, kudos again), and brought up the possibility of starting a bug bounty program with me as a pilot of sorts. Cool, right?<p>Well, after talking to their CISO, it sounds like no such thing will happen. Her reason was, &quot;It&#x27;s not actually a &#x27;bug&#x27;, so it&#x27;s not going to be included in a bug bounty program&quot;. So there goes that idea.<p>I really don&#x27;t get it. I could have just as easily sold everything in there for big monies, or could have personally done havoc of my own. There&#x27;s a certain point where &quot;thanks&quot; just doesn&#x27;t feel enough, especially after the bug bounty comment.