The EU comission offers a reward (up to 5000 € + 20 % if a solution is presented) for finding security vulnerabilities in the following open source software: LibreOffice, LEOS, Mastodon, Odoo and CryptPad
and then it came to me: "joël, you are a journalist! you can just ask them!"
and so I did.
update, so it is in the same thread: there is not (yet?) a EU comission mastodon