Always check for a bounty program beforehand

from here and here

I'm not saying there's anything wrong with wanting something in return for your efforts, but be honest about your motivations and be more curious about how that process works. Don't just assume everyone hands out bug bounties, because they don't, and if the company in question doesn't then it's best to not even mention it.

Frankly, when you approach a company with a report that mentions a deadline to act and payment they never agreed to, quite a few are going to interpret it as some sort of shakedown or blackmail. One of the best indicators that a company won't do that is if they do in fact have a documented bug bounty program.

How not to get a bug bounty

from here (image source)

XP's got plenty of bugs, but they're not going anywhere so it's no use finding those.

Don't ask for money if you know they won't play ball

from here

I suppose this criminal might have gotten caught eventually anyways, but drawing attention to himself in order to get a 1 time payout? That was not a smart move

The hidden costs of innovation

from here

 It's been decades and people still haven't realized the error of allowing web content in the body of the email. Companies are still paying the price, including Apple playing a ton of money for vulnerabilities including at least some that would allow an email worm to spread and did allow researchers to compromise Apple's network.

With innovation there invariably comes new opportunities for exploitation, and while sometimes it may be difficult to see it coming, in this case it was entirely predictable.

All your bugs are belong to us

from here

No one has perfect security, not even the security companies. What's important is how they handle it and it seems like HackerOne handled it pretty well.