People here dislike HackerOne, but afaiu it solves this exact problem. It's the first line of ‘support’ for security reporters.

The fact that the industry currently needs this kind of solution is absurdly comedic. Basically, it would make actual sense to require people to pay ten bucks when posting a report—if they think the report is reasonable and that they would get paid for it.