A detailed comparison of disclosure policies across major bug bounty platforms reveals that researchers who submit through platforms surrender their right to disclose — sometimes forever. When vendors refuse to fix, researchers have no recourse.