Yesh (external)

May 21, 2026

Decisions

Active Todos

Patterns

Decisions (1)

Discretionary bounty offered for Yeshs vulnerability disclosure — case-by-case mode, no formal program

Yesh privately disclosed a vulnerability in ciq.com on 5/19. Peter forwarded to Greg/Bjorn asking if CIQ has paid bounties before. By 5/21 Peter emailed Steve+Bjorn endorsing reward: This is well done on his part, both technically and from a good-actor perspective. I would like us to reward here to encourage this behavior. Steve drafted a response: We do not currently operate a formal public bug bounty program, but would like to offer a discretionary reward for your efforts once validation is complete. Peter explicitly endorsed via DM (Yup!). Peter separately forwarded the disclosure to Justin to fix. Bjorn aligned on the wording earlier. Steve owns the response thread; Justin owns the fix; Bjorn owns sign-off; precedent-setting case for future disclosures.

May 21

operational

Related Patterns (2)

Lead by Example with New Tools

When championing new tools or processes, personally use them and share results rather than just advocating. Learning by doing and demonstrating value through example is more effective than mandates.

118 occurrences78% success

Protect Engineering Focus Through Process

When faced with requests that would disrupt engineering focus (from sales, governance, product, or other stakeholders), establish processes that protect engineering ability to innovate while still satisfying legitimate concerns. Prefer systematic solutions over ad-hoc responses.