I have received anonymous security notices that suggest we should send money to the "researcher" who wishes to remain anonymous. While I appreciate receiving information on security vulnerabilities, if the person who contacts me remains anonymous then I consider their communication to be a threat and extortion.
If anyone wishes to report a security vulnerability in good faith, and they hope for remuneration of any sort, then they need to identify themselves unambiguously.
If anyone wishes to report a security vulnerability in good faith, and they hope for remuneration of any sort, then they need to identify themselves unambiguously.