That seems like an unreasonable expectation, considering he's still in full-time education - so he wouldn't be likely to accept a job offer in any case.
It sounds like he only found XSS, which isn't exactly worthy of a job offer anyway.
It sounds like he only found XSS, which isn't exactly worthy of a job offer anyway.
1) XSS is game over for sites with authentication. What kind of vulnerabilities do you think are more important than XSS?
2) XSS is a result. There are a lot of complicated XSS bugs.