In past threads I’ve heard about exploit brokers and how their rates are typically much higher than bug bounties. If Hacker News commenters know about these avenues I’m sure bug hunters can find ways to cash out for more money. Calling it unclean is stupid anyways, since the company clearly isn’t paying enough for bugs in their own service…this is the same kind of thinking that leads to “responsible disclosure” and all that junk.