How is that sustainable?

Are security researchers going to be doing free labor for you indefinitely for exposure?

They sell their products using the credentials they gained.

I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.