A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be

A slap in the face? I know bug bounty programs are a very good idea, no arguments. If a company doesn't have a formally posted bug bounty, though, I wouldn't be looking for vulnerabilities for money. Approaching a company with no formal structure in place to assess or pay out bounties, and saying 'you owe me a bunch of money' is never going to be a winning proposition. I think what this guy was doing was awesome; he clearly understands the value of the work researchers were doing, and he did what was in his power to thank them. Compared to getting no reaction, or a terse email, this is probably in the top 20% of responses to random vulnerability disclosures.