Welcome to web3 security

There's a legitimate frustration buried in that take, but it rests on a misread of why BBP platforms exist. A bug bounty program is not a contact form. It's a contract. The platform is what makes that contract enforceable on both sides. Projects get filtered signal and predictable triage. Researchers get clear rules, payout SLAs, dispute resolution, and a record of work that compounds into reputation. Other responsible disclosure routes exist for the urgent stuff, SEAL 911 being the obvious one, but the premise sits in the same place. Structure exists so serious work can get through. The "just send details over email" model sounds lightweight until you sit on the receiving side. I triaged thousands of reports running MTS at Immunefi. The cost asymmetry is brutal. A researcher can write a scary-sounding critical report in 15 minutes. Invalidating it takes a senior engineer 1 to 2 hours on average. Sometimes more. Small and medium teams don't have that headcount. The big ones already outsource it. With hacks happening almost daily, projects should be taking security more seriously, and many are. But it remains a genuinely hard problem. BBPs catch what a researcher can find externally on the same surface as an attacker. They don't and can't cover everything. A lot of recent damage has been infrastructure failure rather than code bugs, and that surface is hard to fold into a BBP without monthly or quarterly pentests on top. The platform requirement does one more thing that gets missed in these threads. It self-selects for researchers willing to engage with the process. That friction is a feature, not a bug. If signing up for a platform a project explicitly named in their program rules is the dealbreaker, the report was probably not going to clear the bar anyway. Serious researchers maintain accounts on the major platforms because that's where the work is. The AI era raises the floor of all of this. Anyone can prompt a model to produce a coherent-looking critical report with fabricated impact and confident language. Valid work gets buried under that slop, which is precisely what feeds the scepticism. Structured intake, enforceable rules, and reputation on a platform are the only things that hold up at scale. At least for now. So the real question is what intake model actually gets bugs fixed at scale, not whether platforms add friction. The honest answer is managed triage on a platform, with SEAL 911 and similar channels for the cases that can't wait. Teams that skip this either drown in noise or quietly hire someone to handle it.