Sort:  

what if you accidentally encounter a vulnerability (say you're an expert hacker). If you report that, they decide whether to reward you or not because they didn't employ you?