K8y
Happens all the time but the tipper could be anyone in the world. The project is open source so anyone can check for vulnerabilities. The situation of: a gos employee inserts a vulnerability, hopefully people learned from xz. (A second person looks over pull requests like they should instead of hitting accept in 2 seconds.)
There are bug bounties where people get paid to tell "the good guys" or they could go to a black hat company and get paid there.
I guess GOS would need to have an appetizing bug bounty program.
But, it might never be enough since Pegasus could pay 1 person 1 million for 1 vulnerability.
Gos has many layers of security to get through. It's like: ya there might be a weak spot in the wall, but a security camera is pointed at it and theres a 2nd & 3rd wall to get past.