Thankfully we've historically had a fair amount of attention (and investment in our security) by both customers, our oss users and people our ecosystem.

The interesting thing is that the business model seems to have changed. Why collect a 10k bounty when you can advertise a 3k/month scanner?