If you aren't paying or updating your list of contributors, then I will just email Full-Disclosure, which also doesn't pay but functions as a permanent record of those who meaningfully contribute to security.