Exactly how I see it. People want a higher bounty, and are also curious of any more bugs deeper. But companies want them to stop at the first layer.<p>It seems too difficult to define how deep is too deep, especially since at least he reported him doing it. He didn&#x27;t decide to go that deep and then just report the RCE and collect $10 million from people far more interested in this.