Hacker News Reader

Project Zero does not accept bounties. They generally ask for the money to be donated.

Makes sense. The bug bounty is meaningful money to an individual but it's just a pittance to Google.

I'd assume it also helps avoid the perception of a conflict of interest.

Apple's program has a few very specific classes of bugs that they pay out bounties for: these bugs probably don't qualify.

Probably not. I think that most of those bounties can only be redeemed when you sign an NDA.

(Disclosure: I work for Google)

I meant the NDA from the party where the bug is reported, Apple in this case.