Comment by wslh

This is where despite the bug bounty rules someone at Zendesk (a CXO?) should take action and pay.

I would add that HackerOne could also take an action and influence in the positive outcome and not being just a MiM.