> Did you really get any of these, or were you exaggerating?

All of these, in this single 3-months bug bounty program. I'm absolutely not exaggerating.

> If you really did and they're public anywhere (and the people weren't joking), I'd love to see them. Sounds absolutely amazing.

This is on our private security@ contact. We have one every month, telling us that.

That's amazing ... I don't know how anyone would even get to the point of realizing VLC has a bug bounty progam without also knowing that VLC is an open source program and therefore the source is supposed to be visible.