Indicator disclosure maturity is following the path vulnerability disclosure.

Incident reports on FD?

Indicator bounty programs?

Why not?