Hacker News Reader

So now the game for developers is to include intentional but sufficiently abscure bugs that they can harvest money off down the line.

I don't think developers would be eligible for bounties for vulnerabilities found in their own projects.

Probably not.

However, such a limitation is rather easy to workaround. Which means now, buggy commits are going to look suspicous.

So? You sell your exploits to another dev at a fraction of the bounty, other devs so the same for you. It’s not like that puts up any real obstacle.