Over the last decade or so a global market has developed in bug reporting for bounties. Bruce Schneier writes about a report on how it works: <https://www.schneier.com/blog/archives/2022/01/an-examination-of-the-bug- bounty-marketplace.html> John