Advice sought regarding HackerOne and vulnerability submission (ycombinator.com)