AWS needs three years to not attribute a vulnerability

github.com

3 points_hyn31 comment

Wait, does AWS really not have a bug bounty program? If so, that's really confusing to me!