Correct, the policy isn&#x27;t clear and needs improvement. The bug bounty&#x27;s policy definitely falls under the CSO&#x27;s purview. So even if you approve of Alex&#x27;s handling of the matter, you can&#x27;t forgive him for running a sloppy bug bounty program. It&#x27;s one thing if he claims mea culpa and says we could do better. But there&#x27;s not one iota of regret, remorse, or apology on not making things more clear in Alex&#x27;s response.<p>If you&#x27;re going to persecute someone on details, you had better make sure your policy is very detailed, not vague, and not left open to interpretation. In this regard, Mr. Stamos failed.