> would assume that trying to get a bounty means accepting that you're not selling the vulnerability elsewhere

Having an e-mail from the company confirming the bug is serious and systemic massively raises its market value. Security is necessarily trust less. These game dynamics are unavoidable.

Having an email from the company confirming that they know about the bug probably erases its market value.

Unless it's harder to fix, and easy to short term exploit?

None of us are thinking of any of this before the brokers already have; this work has been going on for many, many years. You can resell vulnerabilities, but the contract terms you get from brokers are tranched, and they stop paying when the vulnerability is burned. Your incentive not to spread your bug around is that you you're cutting your nose off to spite your face, not to mention that you're probably making the terms you'll get for future bugs worse.

> I would assume that trying to get a bounty means accepting that you're not selling the vulnerability elsewhere.

That is a very mistaken assumption. Even NDAs backed by threats from nation state intelligence agencies aren’t sufficient to keep exploits from being resold multiple times.

Also, the ones who sell two or more times, can just claim that the other buyer actually discovered the exploit themselves?

Or maybe that someone in the first buyer's organization resold it?