Always check for a bounty program beforehand

from here and here

I'm not saying there's anything wrong with wanting something in return for your efforts, but be honest about your motivations and be more curious about how that process works. Don't just assume everyone hands out bug bounties, because they don't, and if the company in question doesn't then it's best to not even mention it.

Frankly, when you approach a company with a report that mentions a deadline to act and payment they never agreed to, quite a few are going to interpret it as some sort of shakedown or blackmail. One of the best indicators that a company won't do that is if they do in fact have a documented bug bounty program.

Lose clicks sink ships

found on Make A Meme

Unfortunately it really is important to be careful what you click on. It's dangerous online.

I Hope No One Attacks Symantec's Products Before Mid-July

from here

Symantec certainly aren't doing themselves or their public perception any favours by delaying fixing their product line.

So Much For No Evidence Of Wrongdoing

from here (source image)

Thanks to @evacide for tweeting the best quality version of the invoice I've seen so far.

I gather Hacking Team may have actually said that they had no business relationship with Sudan, and that at the time they said it it was technically true, but only because they'd been ignoring the question for months and had just broken off their relationship with them. Just the sort of weasel-words you'd expect from a shady company like that.

Hope You Weren't Using The Same Password Elsewhere

from here

There are all kinds of signs that a company is just paying lip service to the idea of keeping your information secure - sending you your password when you've forgotten it is just one of them.