No, but I believe it to be fair and proper to compensate someone for the value they provide in the event the org does not (and simply says thank you upon receipt of a genuine vulnerability report).