“Please stop exploring this further, as it seems you could easily break something” has got to be the best reply one can receive to a bug bounty report.
There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions).
So this the best thing you can hear from that standpoint as well.
Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos.
That sounds like a "fun" job...
---
I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in.
There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication.
- https://arstechnica.com/information-technology/2018/04/paner...
- https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583