The dev team discussed this internally a while back. The general feeling is, we don't currently need a compensation program for this (and definitely don't need the additional overhead that one would create - you might be surprised at how long and how angrily some folks will argue for the value of their observation that modifying a page locally results in a page that is locally modified).

That said, we definitely appreciate it when folks who know what they're doing take the time to report problems. Beyond the basic guidelines for responsibly reporting these, I'd add only one:

1. Don't abuse other users when testing. You can use your own account or create sockpuppet accounts, but do not test or demonstrate your theories on (or at the expense of) your unsuspecting peers.

Note that this necessarily discourages the finding or reporting of security vulnerabilities that involve going to another user's house with a wrench. I feel this is an acceptable tradeoff.

The dev team discussed this internally a while back. The general feeling is, we don't currently need a compensation program for this (and definitely don't need the additional overhead that one would create - you might be surprised at how long and how angrily some folks will argue for the value of their observation that modifying a page locally results in a page that is locally modified).

That said, we definitely appreciate it when folks who know what they're doing take the time to report problems. Beyond the basic guidelines for responsibly reporting these, I'd add only one:

1. Don't abuse other users when testing. You can use your own account or create sockpuppet accounts, but do not test or demonstrate your theories on (or at the expense of) your unsuspecting peers.

Note that this necessarily discourages the finding or reporting of security vulnerabilities that involve going to another user's house with a wrench. I feel this is an acceptable tradeoff.

The dev team discussed this internally a while back. The general feeling is, we don't currently need a compensation program for this (and definitely don't need the additional overhead that one would create - you might be surprised at how long and how angrily some folks will argue for the value of their observation that modifying a page locally results in a page that is locally modified).

That said, we definitely appreciate it when folks who know what they're doing take the time to report problems. Beyond the basic guidelines for responsibly reporting these, I'd add only one:

1. Don't abuse other users when testing. You can use your own account or create sockpuppet accounts, but do not test or demonstrate your theories on (or at the expense of) your unsuspecting peers.

Note that this necessarily discourages the finding or reporting of security vulnerabilities that involve going to another user's house with a wrench. I feel this is an acceptable tradeoff.

The dev team discussed this internally a while back. The general feeling is, we don't currently need a compensation program for this (and definitely don't need the additional overhead that one would create - you might be surprised at how long and how angrily some folks will argue for the value of their observation that modifying a page locally results in a page that is locally modified).

That said, we definitely appreciate it when folks who know what they're doing take the time to report problems. Beyond the basic guidelines for responsibly reporting these, I'd add only one:

1. Don't abuse other users when testing. You can use your own account or create sockpuppet accounts, but do not test or demonstrate your theories on (or at the expense of) your unsuspecting peers.

Note that this necessarily discourages the finding or reporting of security vulnerabilities that involve going to another user's house with a wrench. I feel this is an acceptable tradeoff.