docs: vuln reporting tweaks

Author: snarfed

templates/about.html

@@ -491,12 +491,12 @@
 
 <li id="vulnerability" class="question">I found a security vulnerability!</li>
 <li class="answer">
-<p>Oof. Thank you for reporting it! Please send details to <a href="mailto:security@brid.gy">security@brid.gy</a>. We may provide monetary awards for reports of significant vulnerabilities, eg reading or modifying stored access tokens, <em>if</em> you follow these rules:</p>
+<p>Oof. Thank you for reporting it! Please send details to <a href="mailto:security@brid.gy">security@brid.gy</a>, subject to these criteria:</p>
 <ul>
 <li>Vulnerabilities must be in the application itself, not unrelated services like email (eg SPF/DKIM/DMARC).</li>
-<li>Out of scope: rate limiting, XSS/CSRF attacks (Bridgy has no authenticated sessions), <code>/admin/*</code> pages.
+<li>Out of scope: rate limiting, XSS/CSRF attacks (Bridgy has no persistent authenticated sessions), <code>/admin/*</code> pages.
 <li>User data is intentionally public. That's not a vulnerability.</li>
-<li>No automated fuzzing, DoSes, or other high volume traffic. We block this traffic, and it will disqualify you from any possible award.</li>
+<li>No automated fuzzing, DoSes, or other high volume traffic. We block this traffic.</li>
 </ul>
 <p>Otherwise, <a href="https://github.com/snarfed/bridgy/">the code is open source</a>, feel free to try to break in, let us know if you succeed!</p>
 </li>