I&#x27;m more questioning the flow of researcher reports vulnerability, company awards bounty, researcher disputes bounty value, CSO of company contacts CEO of researcher&#x27;s company.  Is that normal escalation procedure?