This is what bugs me a lot, when it comes to bugbounties including HackerOne. The absolute lack of accountability and transparency. One can only hope the companies act in good faith. In my opinion this should rather be handled by an independet organisaton like the CERT community or since it's a vital security interest at state level. Though latter might be prone to conflicting interests as well.