Microsoft now buys bugs, with or without a bounty program
go.theregister.com
: Critical vulnerabilities found in third-party applications eligible for award under 'in scope by default' move