Hacker News Reader

It sounds like you got $1750 for an XSS-equivalent attack. That's high for XSS.

Yes... yes you should have.

I wouldn't beat yourself up over it. There's probably room to develop an exploit valuation model that better helps to translate (time spent on research) + (X% of business/customer impact), where X is a pretty low figure, otherwise companies would never stay in business.

Don't undervalue the intangible permanence of doing the right thing, character outlasts cash come the grave.