I'm torn on this one. A while back I reported an exploit I'd found to a vendor to also get a back a "not a bug" response. Next version in their software had i

I'm torn on this one. A while back I reported an exploit I'd found to a vendor to also get a back a "not a bug" response. Next version in their software had it fixed. They didn't have a bug bounty and I didn't have much interest in it past that I'd rather if fixed that not. If there had been a small bounty on the line and it would have played out the same way, I'm not sure how I would have handled it. I'm all for responsible disclosure and wouldn't have any interest in posting it online or exploiting it. But what is the correct response if money is owed and you've already shared the exploit with the vendor?