I wasn't saying they should pay him. I don't think they should. But having been on the receiving end of this behavior for far too long my point is that he shoul

I wasn't saying they should pay him. I don't think they should. But having been on the receiving end of this behavior for far too long my point is that he should be listened to and not ignored like this. It would be OK if it's just ignoring, I've seen companies very eager to use legal threats too especially if the researcher is an isolated individual and not company. It's not too much to ask to have a security@ mailbox and actually pay attention to it. If you don't have a disclosure process in 2019 then there is no reason you should have your systems exposed (whether that's a gov site or company doesn't make a difference) IMHO The moment you answered I was still editing my post trying to point out that I'm not defending him. Sorry if there was an overlap here.