docs: make bounty forfeiture forward-looking, and fix the level 2 trigger

[aljo242]

Two problems Matt and Eric found reading the blog draft.

Level 2 escalated on "publishing something an attacker can act on immediately", which is true of every disclosure, so it never distinguished anything from level 1.

Retroactively voiding a bounty on an already-submitted report is Immunefi's to enforce under their terms, not ours. Future eligibility is ours, so the consequences now run forward.

Not addressed here: the consequences still only bite downstream teams, not researchers who do not want a pre-disclosure seat.

[greptile-apps]

Confidence Score: 4/5

[Low risk] Updates security policy language on bounty forfeiture.

The PR appears safe to merge, though the suspension wording should clarify how severity-based first-instance escalation works.

Findings

1.  First-instance suspension is unclear ▶

Summary

The PR makes disclosure-related bounty consequences forward-looking and removes the immediately actionable publication trigger from level 2.

• The revised level-2 wording needs to be reconciled with the existing severity-based escalation rule.

_{Reviews (1) · Last reviewed commit: "docs: make bounty forfeiture forward-loo..."}

[greptile-apps]

First-instance suspension is unclear. Level 2 now names only a repeat instance as its trigger, while the policy below says severity can determine the level even for a first instance. That leaves the response team and reporters without a clear rule for a serious first disclosure that warrants suspension but not a permanent block. Please clarify whether severity can trigger a first-instance suspension.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!