Comment by Mystery-Machine

Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Would you rather them not report it to you or even worse, exploit it?