So what protects HackerOne users from companies claiming that every report is a known issue and not paying anything out ever?