I recently discovered a security vulnerability on a SaaS that my university uses. They do not have a bug bounty program (I asked) and, reasonably enough, they want me to responsibly disclose it.I am not going to do anything malicious with the vulnerability and I will responsibly disclose it. However, I am in a humanities PhD with very low earning potential after I graduate and, right now, I have no real income as a student (apart from minimum wage on campus employment).Is it just me or is it unreasonable for a SaaS to expect responsible disclosure without compensating me?