There have been claims that companies are abusing the HackerOne NDA process to cover up security issues: refuse to acknowledge a problem, but weild the NDA to prevent disclosure of the supposed non-existent disclosure.