I think this is what happens your service does not have a responsible disclosure and reward policy. Every fairly important service should have a security page a

I think this is what happens your service does not have a responsible disclosure and reward policy. Every fairly important service should have a security page and you should think of what you should be rewarding for each scenario in advance. Because it will happen and you better give people good reason to stay ethical.