@Xavier59 for me, this is exactly the kind of behavior I want to encourage: you find a vuln, you don't exploit it, you report to everyone having the same vuln, you get paid by most of them. The one I don't want to encourage is: you find a vuln, you exploit the heck out of it, make a lot of money selling stolen info, blackmailing the site's owners, infecting their customers, mining crypto on their servers and sending their AWS usage bill thru the roof....

because we all here know that is what usually happens...

@ConorMancone " They are spending their time and the internet is a safer place." How to agree to this ... If the bug hunter had any interest to make the internet a safer place, he would have gone to the vendor first. I cannot see how the bug hunter interest here is anywhere except making money.

By the way, we actually do have a rule about bug in vendor packages : "Non qualifying bug : Software packages not produced by us"

@Xavier59 making you aware first gives you a heads up to find a mitigation whilst your vendor looks at fixing. If the hacker tells the vendor and not you, the vendor may do nothing...

@Xavier59 How do you know the hunter didn't go to the vendor? I would bet lots of money that the vendor does know and pushing out an update simply isn't a high priority for them. Especially in that case, this is legitimately the correct course of action. Imagine the (very likely) scenario that the vendor never publishes a fix. In that case would you rather here from a bug hunter, or would you rather get hacked? Would you have found out about this if the bug hunter hadn't reached out to you?

@ConorMancone Because I reported the vulnerability to the vendor, who thanked me and published a fix in 12 hours :)

But you're right that we would not have discover the vulnerability without him. I do believe there is no good solution here, only compromise.