Comment by paxys

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing.

They also have contact email addresses listed at the bottom of https://a16z.com/connect, which the researcher conveniently missed.

They were looking for clout, not responsible disclosure.