Comment by michaelf

I agree. If you exploit a site and then say "will you pay me for security audit?", then that's extortion.