You missed a key point, "responsible disclosure". Not only to the company but to the public. I care less about whatever bounty they give or do not give. They could just deny the bug but this lingering is too much. I like Google's program where you have to wait x number of days and then you can disclose any bug. I guess all I wish from these programs is that they fix the bugs fast which is good for them. I did not spent time to enter anywhere. I was just curious 1 day and played around for an hour or two. I guess you are assuming too much about me and my capability and you cared so much as to create an account just to reply to this post...meh :/