That's amazing ... I don't know how anyone would even get to the point of realizing VLC has a bug bounty progam without also knowing that VLC is an open source program and therefore the source is supposed to be visible.