On the other hand, before they started moving to HackerOne, they fixed several issues I reported either the next day or within a week or so. Their security@ was incredibly responsive.
Now it seems it takes forever (I have reports waiting to be paid from them too, even ones they have already fixed.)