Thanks for the clarification, I really appreciate you taking the time to share what you know. It’s reassuring to have a bit more context on the situation, and I completely understand that things have been busy. Hopefully everything can be wrapped up smoothly when the time is right.
Thanks again for the update! 
Hi, I also wanted to ask for clarification regarding a lightwalletd report I submitted before the bounty program was closed.
The vulnerability was confirmed, fixed, and later publicly disclosed, and I received full researcher credit for it.
Since the report was submitted while the ZCG vulnerability bounty program was still active, could ZCG clarify whether it is still being evaluated for a bounty under the previous program terms, and who is responsible for the final severity and payout decision?
Thanks!
@ZCG Forget to tag
Hi ouicate, were you credited for this? You can through the replies and mentions in that GitHub. Seems Zcash team will clarify who owns the report in due time.
@ouicate I think you should look at this again GHSA-h8m8-844p-v3m9 . What do you think? In terms of credit, I can clearly see my name been credited for the report.
I am just saying, maybe Zcash team will clarify more, don’t you think it will be nice to get more clarification? I will also need more clarification and how it works.
I think the credit is actually pretty clear in the advisory @prince. It says the issue was reported by you with a PoC, while the false close-to-tip status and false readiness result were independently reported by me.
This is pretty normal and has happened multiple times with other GHSAs and researchers when closely related issues are found, but with different attack vectors or root causes. They can be bundled into a single advisory while still crediting each researcher separately, and in many cases, the bounty is split accordingly.
So I think it’s best to let the @ZCG work it all out. As @zerodartz explained earlier, they’re already working on it, so there’s no need to rush. I trust they’re handling it properly, and if you can be a little patient, I’m sure it’ll work out well for you. Congrats again! 
@ouicate Thanks brother, hopefully they sort everything soon.your work rate is impressive.
Hi @zerodartz @daira,@ZCG , just following up on the bounty rewards. It has now been more than three months, and we still haven’t received a clear update on when the rewards will be assigned.
Could you please let us know the current status and, if possible, provide an expected timeline? We would really appreciate some clarity on this. Thanks!
Hi @zerodartz @ZCG, I know you people are still working on the bounty issues, but I think little update from the team will go a long way for us.
Right now we don’t even know our faith or how things will be.
Just give us an update.
Thanks
Hi @ZcashGrants
We know you guys are still working through the bounty related stuff and I don’t want to rush anything here
I just wanted to ask if there are any updates on the bounty payments for reports under the “Supporting infrastructure” scope, especially the disclosed reports affecting lightwalletd.
I am only asking for a quick status update, since it’s now been exactly 4 months since the bug bounty program was closed. I’d also really appreciate it if you could share an expected timeline, if there is one.
Thanks and best regards!
Hey team, I wanted to ask if there’s any update on when security researchers who reported vulnerabilities in lightwalletd through the bounty program (bountyzcash .org, which ended in May) can expect to receive their bounty payments
It’s been around 4 months and we still haven’t heard anything. Could you please share any update or at least an estimated timeline if exact dates are not possible yet?
Any help please?
Hi @ZCG some people just received DM messages about payment especially ZODL, please I didn’t receive the message,could there be a reason?
I am still waiting for response for my disclosure
@Prince Thank you for your message. The contact information we received for you was your X account, so we sent you a message there earlier today. To verify that the address comes from the correct person, we’re only contacting reporters through the contact information provided to us.
~FPF on behalf of ZCG
Please just help me clarify, because I did not receive the message.
Thanks @ZCG for the reply, please I just need clarification, the set of messages you out today was it for Zebra or Lightwalletd?
Because if it’s for Zebra which I have a confirmed bug (GHSA-h8m8-844p-v3m9), I didn’t receive any message.
This is my X (@maakayjunior)
I didn’t receive, please verify, you can also check my GitHub linked to the issue above to verify.
My apologies, it looks like it is a different Prince that I was referring to as they have a different X account listed on their GitHub profile.
Thank you so much, @ZCG , I really appreciate, please any update Zebra payment? Any hope at all?
Please @ZCG I will appreciate if can help me share a little light on this question.
For zebra disclosures any update ? Please help thanks
Is it too late to submit a grant proposal for the security reports I submitted to the official Zebra security program a while back?
It looks like several researchers were able to receive rewards for their findings, including findings submitted before the bug bounty program officially started.
I had to step away pretty abruptly due to health issues, so I wasn’t able to follow up on mine at the time.
I currently have 1 accepted CRITICAL, 1 HIGH, and 1 MODERATE severity finding.
Would I need to wait until the Q4 coinholder grant voting period to submit a proposal? Or is there another process I should follow given that these reports were already submitted and accepted?
If anyone has any guidance or has gone through a similar process, I’d really appreciate it!
FYI, the CDRGP Q4 call for proposals period will begin October 30th if you decide to go that route.