Then why the immediate escalation?<p>Wouldn&#x27;t it have made more sense to contact the researcher directly, rather than using his position of power to pressure the researcher&#x27;s company&#x27;s CEO?<p>Why not assume good faith? (Which is what I would think a white hat bug bounty program should assume)