Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work. It

Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work. It would be good if more companies set up bug bounties, and even better if they'd set the reward a bit closer to (reputed) black-market prices.