Yep I have received a genuine report completely unsolicited before, paid a modest bounty and fixed the problem immediately, then took some precautions to ensure any potential data leaks were rendered innocuous.

I was very glad to have received the info and I think folks such as yourself are doing valuable work.