I've had a member of the second group, describing himself as a "certified white hat hacker", sign up for a small SAAS product I'm involved with, mess around a b

I've had a member of the second group, describing himself as a "certified white hat hacker", sign up for a small SAAS product I'm involved with, mess around a bit and then file a slew of "urgent vulnerability reports" of supposed security issues, all of them profoundly so-whattish in the context of a niche business SAAS. When I closed them all without further action, the chap then had the gall to demand payment - or at least a "certificate of appreciation" he could parlay into future business. Needless to say we declined. This lack of any concept of a threat model was precisely why his (considerable) effort was totally wasted and I can imagine similar "researchers" giving the industry as a whole a bad name.