Comment by Biganon

We need an (official) third party, like an escrow. You report to them, they manage the talking with the company, they tell the judge you did nothing wrong because you reported to them, THEY use tables and shit to decide that such and such attack vector is worth this percentage of the company's revenue, this team would have received a hefty sum