[mNovak]

If the bounty money borders on insignificant, there's always public shaming. Demo the exploit in a controlled environment, and let the media cycle go.

[rasz]

why controlled? Last time some dude got frustrated and started dropping zero days pretty much weekly Microsoft finally hired him to make it stop.