I would have preferred to see a proposal to set up a bug bounty program and pay him via that. Then we have one vote and are sorted for the future.