I mean the alternative isn’t that you are selling it on the black market, it’s that you expose the issue in a blog post and the first time google knows is because one of their employees see the post here on hacker news.

You are essentially been paid to fill out forms and keep your mouth shut.