Someone that hacks your systems won't be limited to a single system or domain, I don't see why your reward system should be. Would you rather that vulnerabilit

Someone that hacks your systems won't be limited to a single system or domain, I don't see why your reward system should be. Would you rather that vulnerabilities discovered in out-of-scope systems be sold on forums instead?