Im a little confused. Can you explain how their proposal is a first ammendment violation? If you're reffering to "could be CC'd to [email protected]," I assume they mean make it an option, not make it mandatory. Some companies attack you for trying to disclose bugs and exploits -- saying that you're attempting to ransom.