Everyone has a story about a friend who sold a vuln for X. At least one case though has been documented in an academic paper by a well respected researcher [1].

Everyone has a story about a friend who sold a vuln for X. At least one case though has been documented in an academic paper by a well respected researcher [1]. (That would put the cheque at < 10%) [1] http://weis2007.econinfosec.org/papers/29.pdf http://weis2007.econinfosec.org/papers/29.pdf