[sombremesa]

> I wouldn't have been surprised at "a box of swag" level of compensation.

Back when I was learning to find vulnerabilities and report them, I'd be lucky to get a box of swag. For VG companies, the usual compensation was some amount of free in-game currency or premium subscription for N months. That being said, I didn't ask for compensation anyway, so it was no skin off my nose.

The worst reaction was when I told my university that one of their websites had a broken link that gave you a zip of sensitive student information, and they threatened to call the FBI (in hindsight, I was probably talking to someone non-technical).