As a researcher on Uber's program, I can assure you that OP has no clue what he's talking about. I've made a bunch of money from their program by submitting valid security issues, not this garbage he's complaining about. It's blowing my mind how everyone on HN is just eating this up, so much misinformation.

> Has anyone been paid for these sorts of bounties by Uber? (Short of the $100,000 extortion payout swept under the rug of bug bounties)

They've paid out more than $1,300,000 in bounties, you can view all their payouts here: https://hackerone.com/uber/hacktivity?sort_type=latest_discl...

> Do you trust their code contributions on OSS to not contain malicious attack vectors?

This has nothing to do with anything.

Good to know they aren't actually deadbeats on bugbounties and can chalk up this example to honest disagreement.

As for the rest, it has to do with everything. Would you trust your application's security to code libraries written by a company with the the allegations hanging over Uber? If there's a chance your customer data might be a strategic asset for Uber?

If you check reports that are actually valid, you can see that Uber actually pays for valid issues. Excluding the 100,000, Uber has already paid 1million+ in bug bounty. Please check their hackerone platform :)