You're pretty much doing everything right. You have a respectful disclosure page. It tells people not to disrupt the service. You could, if bogus signups are annoying you, set up a crappy staging instance of your app and direct testers there.<p>I might further:<p>* Fix the disclosure page so that it doesn't reserve thanks for people who find "high or critical" vulnerabilities. Sev:medium in security-researcher-land is XSS and CSRF, both of which probably merit thank-yous. I'd just thank publicly anyone who sends you a <i>valid</i> issue.<p>* Post to Twitter (under a DoorkeeperSecurity alias) the SHA1 hashes of the titles of disclosed vulnerabilities, so you can "notarize" findings and settle grievances about who found what first.<p>* Go ahead and live with people sending you annoying security reports. People will do much worse things to you than that over the coming years. If your service does well, eventually people are going to stop "warning" you about DoS-susceptibility, and just start blackmailing you about DoS attacks.<p>But otherwise, I'm not sure I see the downside here. The alternative, of course, is for people to find flaws on your site and then write up hysterical blog posts about it. Think of the annoyance you're dealing with as a small payment in exchange for (some) control over the security story of your site.