I got a t-shirt some time back for reporting a serious XSS vulnerability.