As much as I am concerned. Security is not a concern in most open source projects.

But, for one reason the other, they might give credit to a vulnerability they find interesting.