On vendor disclosure timelines, bounty programme incentive misalignment, and the psychological contract