of course not. but i would not think it weird if you rewarded me for finding you and telling you your door was open. more to the point, there is a social expec

of course not. but i would not think it weird if you rewarded me for finding you and telling you your door was open. more to the point, there is a social expectation that large companies will be grateful for vulnerability reports, and reward the reporter accordingly; the poster is well within his rights to be disappointed that they did not.