I share @raisedadead’s experience.
In the past years, we and some of our clients have had multiple cases of a security researcher turning to our client or to us with serious security issues that they later reported via HackerOne.
Security researchers are not always focused on the platform; sometimes they’re looking at the network or services tied to a specific company or community. In such a case it feels natural for them to report it to the actual owner of the forum instead of the developers of the software.
An additional complexity is that the security issues could have also been caused by a bespoke plugin or specific configuration.