To apply to be listed is at the moment FREE . One of the criteria for inclusion is ""Demonstrable record of responding to and improving the code after a disclosure of vulnerability" - EMC2 is one of the best in that. Another criteria is Liquidity - we have very nice volumes.