I’d suggest anybody planning on making demands during a bug disclosure get some advice from a lawyer first. If you use the wrong phrasing, it’s very easy to end

I’d suggest anybody planning on making demands during a bug disclosure get some advice from a lawyer first. If you use the wrong phrasing, it’s very easy to end up committing extortion or blackmail. I had some young college students report a very clever bug to me a few years ago, and they chose to take a rather aggressive approach when it came to discussing the bounty. We paid them a sum they were very happy with, but also gave them warning that if they took that same approach with the wrong company they could easily find themselves charged with a crime.