The only compensation I received with this whole situation was the termination of my accounts, and a family members account being terminated as well.
It's very hard to know the reasoning behind the termination as they never gave me any information.
My gut agrees with this statement.
Technically, if a SAR was filed, even the engineer he spoke to would not have known. Every training I've ever taken in that field basically says you don't tell anyone but your company's team that you filed such a report. Not a coworker, not even a Manager.
I was extremely disappointed. :(
Thank you for sharing.
You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
And in practice, it's less than one bit, since not all characters are letters.
So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."