'but I wouldn't fault Twitter for not rewarding this' I would. A researcher who may do this for a living did not get paid for valid work they did. By definitio

'but I wouldn't fault Twitter for not rewarding this' I would. A researcher who may do this for a living did not get paid for valid work they did. By definition that is a scam. And it flys in the face of what a bug bounty program is supposed to insentivise. Every unpaid report is a signal to not submit other valid bugs, undermining the whole program.