It wasnt long ago that notifying a company that they had a vuln was an act that risked prosecution.
Bug bounties are a release valve. They are not a substitute for a job. They will never pay the same as crime. Writeups like this are not going to facilitate relationships with leaders in the security industry. This post and others like them are embarrassingly naive.
Yeah you used to risk prosecution for doing stuff like that, then the site owners realized how brain dead that was and now they are trying to have a normal relationship because it is a huge bonus for them, not because they give a shit about the people who helped them out.
In 2016, everyone deserves privacy and security on the internet. We know and understand the dangers of vulnerabilities better, and I think we should be capable of having some respect and suitably compensating those who do the right thing.
If you can make the internet a more secure place for us to live our lives and make enough to live out of it, more power to you.