A security researcher finds a serious vulnerability in your platform. They report it to you, expecting recognition, a bounty payment, or at minimum a safe process to disclose responsibly. Without a written bug bounty agreement in place, you have no contract governing what the researcher can do with the information,…