Thread. There's something _very_ wrong with Hackerone/Paypal when they're saying "That's invalid, but you still need our permission to disclose it". The whole thing smacks of bad faith https://twitter.com/k8em0/status/1232224441347633152