I know you explicitly said you don't want to, but: participate in all the bug bounty programs you can, responsibly disclose through them, wait until patched (or

I know you explicitly said you don't want to, but: participate in all the bug bounty programs you can, responsibly disclose through them, wait until patched (or give a hard deadline), then post a technical writeup of the bug to a Substack or the like. That will become your "resume" to get your foot in doors.