[basilikum]

If I had to desposit 10$ to report a vulnerability to a company that could get their entire production/business to halt, I'd publish the exploit.

[user_7832]

Presumably you could do it just fine without paying if you didn't want the $1000 necessarily. Reasonably they'd still give you the $1000 even if you said "I don't want the money but you guys have a problem", and they later figure out you're not a bot and you're actually right.