Re: Yikes.
Yes, in most of these cases the appropriate thing to do would be to pay the people who find the problem if they inform the manufacturer first. Normally pen testing is a paid for service, people are willing to do it for free. Give them a few grand for first alert and you've got yourself a nice crowd-sourced test phase.
Biting the hand that feeds IT
