Ethical Security Research on SecureDrop

After a QR-code malware incident aimed at journalists, SecureDrop and Bugcrowd publish ethical research rules — no malware on live instances, no DoS — and add rewards up to $2,500 for valid findings.