You are right, my initial comment excluded morals altogether. I did it to emphasize the low value attribution to the vulnerability discovery. If I were to actua

You are right, my initial comment excluded morals altogether. I did it to emphasize the low value attribution to the vulnerability discovery. If I were to actually face such dilemma, it would include much more complex thought process, including morals. I understand that nobody has to do the research of any sort but my point is that these skills and effort involved are being commoditised very quickly and become comparable to gig economy. Bounty programmes are very very cheap to large corps, compared to the returns involved. Building a substantial infosec division that could match the crowdsourced model is way more expensive.