A common reporting path for bounties and non-bounty vulnerabilities has always been problematic. This leads to weird scenarios where the company cannot accept reports of denial-of-service vulnerabilities because they are out of scope for bounties, for example. Exclusions from bounties are one thing, but not acting on relevant problems is just a bad idea. The typical bounty program terms are also incompatible with multi-vendor disclosure, where no single vendor can take complete ownership over the disclosure process.

The close proximity to the bounty process can also be challenging to corporate reporters because it could give the impression that they are individually soliciting a gift of non-nominal value from a company that is a supplier or customer in other contexts.