Yesh
May 21, 2026 - May 26, 2026
2
Decisions
0
Active Todos
5
Patterns
Categories
Decisions (2)
Reward Yesh for responsible disclosure — CIQ first-ever bug bounty
When Yesh (pentestine@gmail.com) reported a ciq.com vulnerability on 5/21 via email, Peter responded within minutes to Steve Wallace and Bjorn: I would like us to reward here to encourage this behavior. He immediately forwarded the bug detail to Justin Haynes for the fix and aligned with Steve on severity. The reward is still pending execution as of 5/26 — this is the first bug bounty CIQ has ever paid.
Discretionary bounty offered for Yeshs vulnerability disclosure — case-by-case mode, no formal program
Yesh privately disclosed a vulnerability in ciq.com on 5/19. Peter forwarded to Greg/Bjorn asking if CIQ has paid bounties before. By 5/21 Peter emailed Steve+Bjorn endorsing reward: This is well done on his part, both technically and from a good-actor perspective. I would like us to reward here to encourage this behavior. Steve drafted a response: We do not currently operate a formal public bug bounty program, but would like to offer a discretionary reward for your efforts once validation is complete. Peter explicitly endorsed via DM (Yup!). Peter separately forwarded the disclosure to Justin to fix. Bjorn aligned on the wording earlier. Steve owns the response thread; Justin owns the fix; Bjorn owns sign-off; precedent-setting case for future disclosures.
Related Patterns (5)
Executive Sponsorship for Strategic Partnerships
Strategic cross-company initiatives and major client partnerships require executive-level accountability to move at the right pace and ensure proper prioritization.
Small Circle for Sensitive Operations
When executing sensitive strategic operations, keep the circle of informed people as small as possible to prevent leaks that could accelerate hostile action or undermine the initiative.
Protect Engineering Capacity
When external demands threaten to overload engineering capacity, protect capacity by either requiring the demand to come with additional resources, or forcing hard prioritization choices upstream.
Lead by Example with New Tools
When championing new tools or processes, personally use them and share results rather than just advocating. Learning by doing and demonstrating value through example is more effective than mandates.
Protect Engineering Focus Through Process
When faced with requests that would disrupt engineering focus (from sales, governance, product, or other stakeholders), establish processes that protect engineering ability to innovate while still satisfying legitimate concerns. Prefer systematic solutions over ad-hoc responses.