Plus, by having a bug bounty program, it indicates that they're going to be reasonable and accepting of outside bug reports. In the absence of such a program, one can't be sure that a bug report isn't going to result in angry phone calls from tech-illiterate people accusing you of hacking them.
I recently found a compromised server on a university's network. I wasn't going to cold call them to report it because I had no idea how Betty answering the phones would react. Instead, I sent it to an IT contact that I knew personally. I knew that he didn't have anything at all to do with this, but that he would know who to get it to.
I recently found a compromised server on a university's network. I wasn't going to cold call them to report it because I had no idea how Betty answering the phones would react. Instead, I sent it to an IT contact that I knew personally. I knew that he didn't have anything at all to do with this, but that he would know who to get it to.