Not sure how to think about that. I'd expect a pen tester to live of the money they get for the pentest and not make extra money with bounties from the time spe

Not sure how to think about that. I'd expect a pen tester to live of the money they get for the pentest and not make extra money with bounties from the time spent during that pentest. If the bug was in the software of another vendor then that's not as clear, but I'm still not sure if the pentester should be entitled to a bounty. If anything, maybe the client should get the bounty as they hired and paid for the pentester to find vulns?