Security disclosures are like giving someone an unsolicited gift. The receiver is obligated to return the favor.
But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.
But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.
In this case, the spot turned out to be a freckle, which everyone involved already knew was a freckle (since it was documented), and if anyone owes anyone anything, it's the researcher that owes github for wasting their time.
Exactly.
> The receiver is obligated to return the favor.
Not at all. This is a very toxic expectation.