Except coldcard was known not to pay bug bounties. There were multiple instances where vulnerabilities were disclosed and no bounty was paid. A team of researchers received cold cards and coffee mugs for their disclosure 😂

I became aware of this later lol I didn't know the whole lore but every time a company behaves like this, this is what happens, in crypto this is what thorchain did too. always need to be aware of how companies treat security researchers before buying their products