Which tracked vendors have public bug bounty programs — and on which platform. Bug bounty coverage is a signal of proactive security investment, separate from CVE history.