Even their newly developed responsible disclosure program doesn't have bounties.
You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
And in practice, it's less than one bit, since not all characters are letters.
So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."