ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.
What kind of auction would you like to run?
Remember that you can sell the same vulnerability to multiple people: it's software you can copy.
it seems unlikely google's lawyers would go for this
What kind of auction would you like to run?
Remember that you can sell the same vulnerability to multiple people: it's software you can copy.