To triage reports, assess their impact, and communicate effectively with researchers.

To maintain the anonymity of all bug reporters.

To avoid paying researchers unless the vulnerability is critical.

To ensure immediate public disclosure of all vulnerabilities.