Yes, there's no contract and I didn't start out expecting to come across a vulnerability so obviously there was no outcome expectation on my part. I think I'm

Yes, there's no contract and I didn't start out expecting to come across a vulnerability so obviously there was no outcome expectation on my part. I think I'm feeling frustrated that industry credibility is not meaningful to me because this is not my industry and the expectation of pro bono responsible disclosure means that they take advantage of my expertise when (1) I never offered it and (2) they pay developers to do this kind of work all the time. I think you're helping me get at an underlying question I have: is it fair to say, "if you're running a SaaS, you should have a bug bounty program?"