Security is operational: disclose, fix, verify, repeat. The Cosmos bounty report was a solid example of that cycle working end to end.