Worse than that, you have probably (as I have) reported plainly-obvious security vulnerabilities with at least a faint twitch of nervousness that the recipient is going to flip out and start suing or something. Worse than no expectation of reward from a utility point of view!