@foone you can make some money (not a lot) from responsible disclosure to bug bounty programs

But many companies like this don't have structured and rewarded bug bounty programs