We're aware of the public discussion regarding a recent bug bounty dispute. We understand the frustration that can come with these situations, for researchers and projects alike. But we don't believe public forums are the right place to evaluate vulnerability severity, debate payout amounts, or litigate the specifics of a report while a dispute is not concluded. That approach risks compromising the quality of discussion and the resolution process itself. Since mediation over payout amount was not requested, we have self-initiated mediation to examine the specifics of the report, which takes time because of the complexity involved, but we’ll take the appropriate actions after coming to a conclusion. In the meantime, we’ve paused the project to make sure that appropriate attention is given to any outstanding reports.