Me: Hi, X site has security vulnerabilities (SQL injection and XSS) that allowed me to access your machines.

FR Hosting: X belongs to one of our customers, not ours. Your report therefore does not enter our bug bounty program and is rejected.

M: I don't care about the BB program, fix the vulnerabilities, I have access to YOUR machines.

H: Your report does not enter our BB program and is rejected.

*3 h later*

H: Could you please provide us a PoC and tell us which data you gain access to?