Is the bug bounty through a platform like HackerOne / Bugcrowd? Or do they just have a private VDP and the money is a bonus on top?