It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Se

It looked bad at first glance, but keep in mind they had no bug bounty program. Information about vulnerability reporting never said there would be a reward. Security bounties are a fairly recent trend, and I'd wager 99% of the web has no such policy in place. Maybe we expect the bigger companies to have one, but there's no guarantee. In the end, when no bounty is promised up-front, you can either take the low road and sell it on a forum, or take the high road and enjoy your T-shirt. Whether or not you're a good or bad citizen is up to you.