Bug bounties are a) professional courtesy to say "thanks for telling us" and b) a way to incentivise someone to write up the bug report. Otherwise, if I as a w

Bug bounties are a) professional courtesy to say "thanks for telling us" and b) a way to incentivise someone to write up the bug report. Otherwise, if I as a white hat discovered this bug, I might just not bother reporting it. I wouldn't exploit it, but the next guy might. Hence, bug bounty programs.