I'll answer from the other side of the fence. I'm a semi-indi-developer. I mostly make software tools, almost all of which is distributed as source code. (it's

I'll answer from the other side of the fence. I'm a semi-indi-developer. I mostly make software tools, almost all of which is distributed as source code. (it's not open source, but licensees get it as source code) I get bug reports all the time. Some come with suggested fixes. Some discuss vulnerabilities. All are accepted with appreciation. All people I correspond with use their real names. I don't have a bug bounty program, but folk who are helpful get discounts, and in some cases free licenses to other bits. Of course YMMV. But if it was me I'd just email them the info.