This is why I never ever "report" security vulnerabilities without first having a contract with the afflicted party. It sucks, but I am not willing to be burned

This is why I never ever "report" security vulnerabilities without first having a contract with the afflicted party. It sucks, but I am not willing to be burned as a witch just because I understand security.