The policy should state how and under what conditions reporters are recognized (credit in the advisory, an acknowledgements page), always with the reporter's agreement and in the form they choose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.