I am #1 on many bug bounty programs in crypto. Including Binance, Bybit, Upbit, Kucoin, OKX and more. Occasionally we have had several clients who use a 3rd party app within their main tools. We found several RCEs in something that is being used by several top crypto projects, including our clients. I registered on @immunefi just for the sake of reporting that and because some people wanted me to join the club. I am not gonna tell the details at the moment, but I honestly don't trust either immunefy or the program itself.

The funny part is that the program removed that particular scope from the BB program 2 days after I submitted an RCE. I can tell that right now hundreds are affected.