[planetpluta]

Maybe not “immediate” but withholding rewards results in fewer researchers participating in bounty programs which defeats the purpose.

[jtbayly]

Not if the (true) purpose of having the bounty program is simply PR, rather than an honest desire to find and fix bugs.

[tptacek]

The true purpose of these programs is to direct research to specific threats and engineering areas.