100%. We want to ensure we can fix real security issues responsibly before details are published. In practice, if a researcher asks to disclose after we've addressed the issue, we're happy for them to publish.

▲

DANmode 19 hours ago | parent [-]

In practice, it sounds like you guys didn't accept this dude's valid vuln because he didn't register and sign his life away.

▲

tptacek 14 hours ago | parent [-]

They just stated it was all just model hallucination, and was not in fact a valid vuln.

▲

DANmode 13 hours ago | parent [-]

shrugs If you're convinced, I'm convinced!

	▲	tptacek 13 hours ago \| parent [-]
		I'm convinced.