[mort96]

I also understand the "motive": money. If you can spam enough maintainers with bullshit vulnerability reports, there's a chance you'll hit something real or trick a maintainer and get a pay-out.

[nikanj]

Or you can use your track-record of discovering CVEs as a stepping stone to a cushy infosec job