But you also minimize the risk that someone else will find and report the vulnerability before you do, negating any & all chance of earning a bounty yourself.